#!/usr/bin/perl
# 
# filechucker.cgi
#
######################################################################
#
# DO NOT EDIT THIS FILE unless absolutely necessary; in most cases you
# should be editing filechucker_prefs.cgi instead.  If you do edit
# this file, be sure to make a backup copy first.
# 
######################################################################
#
# This program is the copyrighted work of Encodable Industries.
# Redistribution is prohibited, and copies are permitted only for
# backup purposes.  You are free to modify the program for your
# own use, but you may not distribute any modified copies of it.
#
# Use of this program requires a one-time license fee.  You can
# obtain a license here:
#
#	http://encodable.com/filechucker/#download
#
# This software comes with no warranty.  It is our hope that you
# find it useful, but it comes with no guarantees.  Under no
# circumstances shall Encodable Industries be held liable in any
# situation arising from your use of this program.
#
# For more information about this program, as well as for help
# and support, please visit the following pages:
#
# Homepage: http://encodable.com/filechucker/
# Contact: http://encodable.com/contact/

my $version = "4.86";
use CGI::Carp 'fatalsToBrowser';
$ENV{PATH} = '/bin:/usr/bin:/usr/local/bin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
($ENV{DOCUMENT_ROOT}) = ($ENV{DOCUMENT_ROOT} =~ /(.*)/); # untaint.
#$ENV{DOCUMENT_ROOT} = 'c:\some\dir'; # If autodetection fails, uncomment & set this.
#$ENV{SCRIPT_NAME} = '/cgi-bin/filechucker.cgi'; # If autodetection fails, uncomment & set this.
use lib './perlmodules';
use lib '../cgi-bin/perlmodules';
use lib '../../cgi-bin/perlmodules';
use lib "$ENV{DOCUMENT_ROOT}/cgi-bin/perlmodules";
use lib "$ENV{DOCUMENT_ROOT}/../cgi-bin/perlmodules";
my (%PREF,%TEXT,%COOKIE) = ();
#use Time::HiRes 'gettimeofday'; $PREF{script_start_time_highres} = gettimeofday();

my $debuglog = undef;

$| = 1;
use strict;
#use warnings;
use Fcntl;
use POSIX;
use File::Copy;
use Digest::MD5 'md5_hex';

sub printd;
sub die_nice;
sub enc_warn;
sub encdebug;
sub encdebuglog;
sub exit_with_error;

# Set globals. TODO: some of these need to be re-scoped.
my ($qs, $starttime, $total_upload_size, %temp, $num_files_in_progress_or_done, $total_file_count, $shortdatetime, $shortdatetime_forfilename, $datestring8) = ();






sub print_new_upload_form()
{
	exit_with_access_denied('upload') unless user_is_allowed_to('upload');
	$PREF{userdir} = $PREF{enable_userdirs} = '' if $PREF{enforce_userdir_restrictions_on_upload_page} =~ /no/i;

	my $juststatus = $qs =~ /(?:^|&)juststatus(?:&|$)/ ? 1 : 0;
	my $hiddenstyle = qq`style="position: absolute; left: -10000px; overflow: hidden; height: 0;"`;

	$PREF{on_page} = $juststatus ? 'popupstatus' : 'uploader';

	print_http_headers();
	print_new_upload_form___firsthalf( $juststatus,$hiddenstyle) unless $qs =~ /output=secondhalf/;
	print_new_upload_form___secondhalf($juststatus,$hiddenstyle) unless $qs =~ /output=firsthalf/;
}


sub print_new_upload_form___firsthalf
{
	my ($juststatus,$hiddenstyle) = @_;

	my @dirs = get_all_writable_directories();
	exit_with_access_denied() unless @dirs;

	start_html_output($PREF{subtitle___uploader});

	my $numitems = $total_file_count;
	$numitems = 1 if $numitems > $PREF{max_files_allowed};
	$numitems = $PREF{num_custom_file_elements} if $PREF{using_custom_file_elements} =~ /yes/i;

	if($PREF{in_reprocessing_mode})
	{
		$numitems = 0;
		my @qsitems = split(/&/, $qs);
		foreach my $item (@qsitems)
		{
			if($item =~ /^ffs\d+=file-(.+)/)
			{
				my $filename = $1;
				enc_urldecode($filename);
				$numitems++;
				$PREF{reprocessing_file_names}{$numitems} = $filename;
			}
		}
	}


	# The onsubmit() in this <form> is only fired when someone presses Enter when a textbox is focused.  The upload button has its own call to onsubmit().
	#
	print qq`<form name="theuploadform" id="theuploadform" method="post" enctype="multipart/form-data" action="$ENV{SCRIPT_NAME}?action=incoming&amp;`
	 . ($PREF{using_custom_file_elements} =~ /yes/i ? qq`items=$PREF{num_custom_file_elements}&` : '')
	 . ($qs ? "$qs&" : '')
	 . qq`serial=$PREF{serial}" onsubmit="return startupload()" `
	 . ($juststatus ? $hiddenstyle : '')
	 . ($PREF{use_iframe_for_upload} =~ /yes/i ? qq`target="fc_upload_iframe" ` : '')
	 . qq`accept-charset="UTF-8" `
	 . qq`>\n\n`;


	print get_special_upload_note();


	print qq`<input type="hidden" name="numitems" id="numitems" value="$numitems" />\n`;
	print qq`<input type="hidden" name="numfileelements" id="numfileelements" value="$numitems" />\n`;



	print process_custom_form_fields_code($PREF{custom_form_fields_top___code});
	my $top_textboxes = get_textboxes('top');
	print qq`$top_textboxes\n\n\n\n` if $top_textboxes;
	print $PREF{extra_HTML_output_just_before_file_fields};

	my $subdir_dropdown_visible = 0;
	my $new_subdir_field_visible = 0;

	if($PREF{using_custom_file_elements} !~ /yes/i   &&   $PREF{num_default_file_elements} != 0)
	{
		print qq`<div id="filefields">\n` if $PREF{print_filefields_wrapper_div} =~ /yes/i;
		print qq`<div id="choosefiles_title">$PREF{choosefiles_title}</div>\n` if $PREF{choosefiles_title};

		my $subdir_from_url = '';
		if($qs =~ /(?:^|&)path=(.+?)(?:&|$)/)
		{
			$subdir_from_url = $1;
			enc_urldecode($subdir_from_url);
			$subdir_from_url = enc_untaint($subdir_from_url, 'keep_path');
			slashify($subdir_from_url);
		}

		for(my $i=1; $i<=$numitems; $i++)
		{
			my $row = ($i % 2) ? 'odd' : 'even';

			my $custom_perfile_code = $PREF{custom_form_fields_perfile___code};
			$custom_perfile_code =~ s/_%i/_$i/g;
			my $perfile_textboxes = get_textboxes('perfile', $i);

			if($PREF{in_reprocessing_mode})
			{
				print qq`<div id="firstfile" class="$row` . ($PREF{list_filenames_on_reprocessing_form} =~ /yes/i ? ' onesubgroup' : '') . ($i == 1 ? ' first' : '') . ($i == $numitems ? ' last' : '') . qq`">`;

				if($i == 1   &&   $PREF{reprocessing_mode_file_list_message})
				{
					my ($folder_name) = ($subdir_from_url =~ m!([^/]+)/*$!);
					$folder_name = '/' unless $folder_name;

					$PREF{reprocessing_mode_file_list_message} =~ s/%%folder_name%%/$folder_name/g;
					$PREF{reprocessing_mode_file_list_message} =~ s/%%num_files%%/$numitems/g;
					print $PREF{reprocessing_mode_file_list_message};
				}

				print qq`<input type="` . ($PREF{list_filenames_on_reprocessing_form} =~ /yes/i ? 'text' : 'hidden') . qq`" class="textfield reprocessingfile" name="$PREF{filefield_namebase}$i" id="$PREF{filefield_namebase}$i" value="$PREF{reprocessing_file_names}{$i}" readonly="readonly" />\n`;

				my $subdir = ();
				if($subdir_from_url)	{ $subdir = $subdir_from_url;								}
				else			{ $subdir = $PREF{userdir} ? qq`/$PREF{userdir_folder_name}/$PREF{userdir}/` : '/';	}
				print qq`<input type="hidden" name="subdir$i" value="$subdir" />\n`;

				print process_custom_form_fields_code($custom_perfile_code) if $custom_perfile_code;
				print $perfile_textboxes if $perfile_textboxes;

				print qq`</div>\n`;
			}
			else
			{
				my $filefield_template = $PREF{filefield_template};

				my ($subdir_template) = ($filefield_template =~ m!%%%template:subdirlist%%%(.+?)%%%end-template:subdirlist%%%!gs);
				my $subdir_template_output = '';

				$filefield_template =~ s!%%file_upload_field_label%%!$PREF{"file_upload_field_label_$i"} || $PREF{file_upload_field_label}!eg;
				$filefield_template =~ s!%%i%%!$i!g;
				$filefield_template =~ s!%%numitems%%!$numitems!g;
				$filefield_template =~ s!%%row_classname%%!$row!g;
				$filefield_template =~ s!%%first_classname%%!$i == 1 ? 'first' : ''!eg;
				$filefield_template =~ s!%%last_classname%%!$i == $numitems ? 'last' : ''!eg;
				$filefield_template =~ s!%%required_classname%%!$i == 1 && $PREF{allow_form_submissions_without_files} eq 'no' ? 'required' : ''!eg;
				$filefield_template =~ s!%%auto_add_more_files%%!$PREF{add_new_file_upload_fields_automatically} eq 'yes' && $PREF{max_files_allowed} > 1 ? qq`add_file_element_if_necessary();` : ''!eg;


				my $display_subdir_dropdown =	$PREF{display_dropdown_box_for_subdir_selection} =~ /yes/i
								&& user_is_allowed_to('choose_subdir_during_upload')
								&& !($subdir_from_url && $PREF{hide_subdir_dropdown_when_passed_on_url} =~ /yes/i)
								&& !($i > 1 && $PREF{only_allow_one_subdir_dropdown_per_upload} =~ /yes/i)
				;

				my $display_newsubdir_field =	$PREF{show_the_create_new_subdir_field_on_upload_form} =~ /yes/i
								&& user_is_allowed_to('create_folders_during_upload')
								&& !($PREF{only_allow_one_new_subdir_per_upload} =~ /yes/i   &&   $i > 1)
				;


				my $static_subdir = '';
				my $newsubdir_instructions = '';

				if($PREF{enable_subdirs} =~ /yes/i)
				{
					my (@dirs_pruned,@displaynames_pruned) = ();
					my $uploaded_files_url_path = get_uploaded_files_url_path('without_trailing_slash');
					foreach my $dir (@dirs)
					{
						slashify($dir);

						# Each $dir here can contain one or more levels (i.e. can contain slashes),
						# does NOT include the leading "/upload/files", and for userdirs, does
						# include the leading "/users/Bob".

						next if $PREF{force_all_uploads_into_subdirectories} =~ /yes/i && $dir eq '/';
						next if $PREF{force_all_uploads_into_subdirectories} =~ /yes/i && $PREF{userdir} && $dir eq qq`$uploaded_files_url_path/$PREF{userdir_folder_name}/$PREF{userdir}/`;
						next if item_is_hidden($dir);
						next if $PREF{hide_upload_form_folders_matching_this_regex} && $dir =~ m!$PREF{hide_upload_form_folders_matching_this_regex}!i;
						my $dirlist = get_qs_var('dirlist'); next if $dirlist && $dir !~ m!$dirlist!i;
						push @dirs_pruned, $dir;
						my $displayname = $uploaded_files_url_path . $dir;
						push @displaynames_pruned, $displayname;
					}

					if($display_subdir_dropdown)
					{
						$subdir_dropdown_visible = 1;

						remove_common_leading_substring(@displaynames_pruned) if $PREF{hide_common_leading_path_on_upload_form_subdirs} =~ /yes/i;

						my $dir_i = 0;
						for(@dirs_pruned)
						{
							my $displayname = $displaynames_pruned[$dir_i];
							my $subdir_template_local = $subdir_template;
							$subdir_template_local =~ s!%%subdir_displayname%%!$displayname!g;
							$subdir_template_local =~ s!%%subdir_value%%!$_!g;
							#
							# 20110421: why were we ever matching subdir_from_url against the *display*name?
							#
							#$subdir_template_local =~ s!%%subdir_selected%%!$displayname eq $subdir_from_url ? qq`selected="selected"` : ''!eg;
							$subdir_template_local =~ s!%%subdir_selected%%!$_ eq $subdir_from_url ? qq`selected="selected"` : ''!eg;
							$subdir_template_output .= $subdir_template_local;
							$dir_i++;
						}
					}
					else
					{
						if($subdir_from_url)	{ $static_subdir = $subdir_from_url;									}
						else			{ $static_subdir = $PREF{userdir} ? qq`/$PREF{userdir_folder_name}/$PREF{userdir}/` : $dirs_pruned[0];	}
					}

					if($display_newsubdir_field)
					{
						$new_subdir_field_visible = 1;
						#$newsubdir_instructions = $display_subdir_dropdown ? qq`<span class="note_newsubdir">$TEXT{will_be_created_inside___}</span>` : '';
						$newsubdir_instructions = $display_subdir_dropdown ? $TEXT{will_be_created_inside___} : '';
					}
				}

				$filefield_template =~ s!%%%if-subdirs%%%(.*?)%%%endif-subdirs%%%!$PREF{enable_subdirs} eq 'yes' ? $1 : ''!egs;
				$filefield_template =~ s!%%%ifelse-choosesubdir%%%(.*?)%%%else%%%(.*?)%%%endelse-choosesubdir%%%!$display_subdir_dropdown ? $1 : $2!egs;
				$filefield_template =~ s!%%%if-newdir%%%(.*?)%%%endif-newdir%%%!$display_newsubdir_field ? $1 : ''!egs;
				$filefield_template =~ s!%%%template:subdirlist%%%(.+?)%%%end-template:subdirlist%%%!$subdir_template_output!gs;
				$filefield_template =~ s!%%static_subdir%%!$static_subdir!g;
				$filefield_template =~ s!%%newsubdir_instructions%%!$newsubdir_instructions!g;

				interpolate_vars_from_prefs($filefield_template);

				$filefield_template =~ s!%%custom_perfile_code%%!process_custom_form_fields_code($custom_perfile_code)!eg;
				$filefield_template =~ s!%%perfile_textboxes%%!$perfile_textboxes!g;

				print $filefield_template;
			}
		}
		print qq`</div>\n\n\n\n` if $PREF{print_filefields_wrapper_div} =~ /yes/i;

		if($PREF{max_files_allowed} > 1   &&   $PREF{using_custom_file_elements} !~ /yes/i   &&   !$PREF{in_reprocessing_mode}   &&   $PREF{show_add_another_file_link} =~ /yes/i)
		{
			print qq`\n<div id="addanotherfile"><a href="#" onclick="add_file_element();return false">$TEXT{Add_another_file_}</a></div>`;
		}
	}


	print $PREF{extra_HTML_output_just_after_file_fields};
	my $bottom_textboxes = get_textboxes('bottom');
	print $bottom_textboxes if $bottom_textboxes;
	print process_custom_form_fields_code($PREF{custom_form_fields_bottom___code});


	print qq`<div id="subdir_dropdown_visible"></div>\n` if $subdir_dropdown_visible;
	print qq`<div id="new_subdir_field_visible"></div>\n` if $new_subdir_field_visible;
}


sub print_new_upload_form___secondhalf
{
	my ($juststatus,$hiddenstyle) = @_;


	print get_human_test_form() if ($PREF{enable_human_test} =~ /yes/i && image_humantest_possible());

	print qq`<div id="juststatuswrapper" $hiddenstyle><a href="$PREF{here_popupstatus_qsready}action=upload&amp;juststatus&amp;serial=$PREF{serial}" id="juststatuslink" target="_blank"></a></div>\n` if $PREF{show_upload_status_in_popup_window} =~ /yes/i;

	print qq`

	$PREF{upload_button}

	</form>

	`;




	print $juststatus
	? qq`<div id="progBarPlaceholder">$PREF{progress_bar_placeholder_message__popup}</div>`
	: qq`<div id="progBarPlaceholder" $hiddenstyle>$PREF{progress_bar_placeholder_message}</div>`
	;



	my $chosen_filenames_element = qq`<div id="chosen_filenames"></div>` if $PREF{show_chosen_filenames_during_upload} =~ /yes/i;



	print qq`

	<div id="progBarError" $hiddenstyle></div>

	<div id="progBarContainer" $hiddenstyle>

	$chosen_filenames_element

	<div id="theMeter">
		<div id="progBar">
			<div id="progBarDone"></div>
		</div>
		<div id="progBarText">
			<div id="progRate">? $PREF{KB}/s</div>
			<div id="progStatus">$TEXT{Connecting_please_wait_}</div>
			<div id="progPercent">? %</div>
		</div>
	</div>

	<div id="uploadCompleteMsg" ` . ($juststatus ? '' : $hiddenstyle) . qq`></div>

	` . ($PREF{show_progress_table_during_uploads} =~ /yes/i ? qq`
	<table>
	<tr id="upload-row-1"><td id="tca1"></td><td id="tca2" class="headercell">$TEXT{Files}</td><td id="tca3" class="headercell">$TEXT{Size}</td><td id="tca4" class="headercell">$TEXT{Time}</td></tr>
	<tr id="upload-row-2"><td id="tcb1" class="headercell">$TEXT{Total}</td>	<td id="totalf">$total_file_count</td>	<td id="totals">?</td>		<td id="totalt">??:??:??</td></tr>
	<tr id="upload-row-3"><td id="tcc1" class="headercell">$TEXT{Completed}</td>	<td id="donef">0</td>			<td id="dones">0</td>		<td id="donet">00:00:00</td></tr>
	<tr id="upload-row-4"><td id="tcd1" class="headercell">$TEXT{Remaining}</td>	<td id="leftf">$total_file_count</td>	<td id="lefts">?</td>		<td id="leftt">??:??:??</td></tr>
	</table>
	` : undef) . qq`

	$PREF{cancelbutton}

	</div>


	<div id="uploadDoneContainer"></div>

	`;




	print qq`<iframe src="" name="fc_upload_iframe" id="fc_upload_iframe" width="1" height="1" onload="show_upload_iframe_contents();" $hiddenstyle><p>Your browser does not support iframes.</p></iframe>\n` if $PREF{use_iframe_for_upload} =~ /yes/i;




	print qq`<form id="enc_comm_layer" method="get" action="/" onsubmit="return false;">\n`;
	print qq`<input type="hidden" name="onload_happened" id="onload_happened" value="0" />\n`;
	print qq`<input type="hidden" name="fcht3" id="fcht3" value="$PREF{humantest_hash}" />\n` if $PREF{humantest_hash};
	print qq`<input type="hidden" name="fcht4" id="fcht4" value="$PREF{humantest_code}" />\n` if $PREF{humantest_code} && $PREF{human_test_is_invisible} =~ /yes/i;
	print qq`</form>\n`;
	print qq`<div id="fcdebug"></div>\n` if $PREF{debug};
	print qq`<div id="fcclearpage"></div>\n` if $PREF{clear_page_during_upload} =~ /yes/i;
	print qq`<div id="showprogtable"></div>\n` if $PREF{show_progress_table_during_uploads} =~ /yes/i;
	print qq`<div id="fcjuststatus"></div>\n` if $juststatus;
	print qq`<div id="upload_progress_bar_disabled"></div>\n` if $PREF{upload_progress_bar_disabled} =~ /yes/i;
	print qq`<div id="popup_status_window_enabled"></div>\n` if $PREF{show_upload_status_in_popup_window} =~ /yes/i;
	print qq`<div id="ht_is_invisible"></div>\n` if $PREF{human_test_is_invisible} =~ /yes/i;
	print qq`<div id="only_one_subdir_dropdown"></div>\n` if $PREF{only_allow_one_subdir_dropdown_per_upload} =~ /yes/i;
	print qq`<div id="only_one_new_subdir"></div>\n` if $PREF{only_allow_one_new_subdir_per_upload} =~ /yes/i;
	print qq`<div id="use_iframe_for_upload"></div>\n` if $PREF{use_iframe_for_upload} =~ /yes/i;



	delete_old_files();
	finish_html_output();
}


sub hook
{
	my ($current_filename, $buffer, $bytes_read, $logfh) = @_;
	my $current_file_has_been_logged = 0;
	my ($progress,$currentfile,$totalfiles,$totalsize,$start_time) = ();
	my $serial = $PREF{serial};
	my @logcontents = ();


	# We're still the original process that's accepting the upload, so
	# we don't need to ask the backend for this now, we can store it
	# in a hash for easier retrieval:
	#
	$progress	= $PREF{uploaddata}{$serial}{progress};
	$currentfile	= $PREF{uploaddata}{$serial}{currentfile};
	$totalfiles	= $PREF{uploaddata}{$serial}{totalfiles};
	$totalsize	= $PREF{uploaddata}{$serial}{totalsize};
	$start_time	= $PREF{uploaddata}{$serial}{start_time};



	# There are three possibilities here:
	#
	#	1. $current_filename has already been logged (i.e. it's in @allfiles)
	#	   and its size has either gone up, or stayed the same;
	#
	#	2. $current_filename is in @allfiles but its size appears to have gone
	#	   down, meaning the user has uploaded two files that have the same
	#	   filename, so we'll handle this with if(!$current_file_has_been_logged);
	#
	#	3. $current_filename is NOT in @allfiles, which we'll also handle with
	#	   if(!$current_filename_has_been_logged).

	my $new_progress = ();
	my (@allfiles) = split(m!///!, $progress);
	for(@allfiles)
	{
		if(/(.+)=(\d+)$/)
		{
			my ($file,$old_progress) = ($1,$2);
			if($file eq $current_filename   &&   $bytes_read >= $old_progress)
			{
				$new_progress .= "${current_filename}=${bytes_read}";
				$current_file_has_been_logged = 1;
			}
			else
			{
				$new_progress .= "${file}=${old_progress}";
			}
			$new_progress .= "///";
		}
	}

	if(!$current_file_has_been_logged)
	{
		unless(!$current_filename  ||  $bytes_read !~ /^\d+$/)
		{
			$new_progress .= "${current_filename}=${bytes_read}";
			$num_files_in_progress_or_done++;
		}
	}



	# Update our hash for the next time hook() is called.  We'll still update
	# the backend below, so the client can get the info too.
	#
	$PREF{uploaddata}{$serial}{progress}	= $new_progress;
	$PREF{uploaddata}{$serial}{currentfile}	= $num_files_in_progress_or_done;
	$PREF{uploaddata}{$serial}{totalfiles}	= $total_file_count;
	$PREF{uploaddata}{$serial}{totalsize}	= $total_upload_size;
	$PREF{uploaddata}{$serial}{start_time}	= $starttime;



	if($PREF{use_database_for_temp_data} =~ /yes/i)
	{
		sql_untaint($new_progress, $num_files_in_progress_or_done, $total_file_count, $total_upload_size, $starttime, $PREF{serial});
		my $sth = $PREF{dbh}->prepare("UPDATE $PREF{table_name_for_temp_data} SET progress='$new_progress', currentfile='$num_files_in_progress_or_done', totalfiles='$total_file_count', totalsize='$total_upload_size', start_time='$starttime' WHERE serial='$PREF{serial}';");
		$sth->execute or die "$0: $DBI::errstr\n";
	}
	else
	{
		seek $logfh, 0, 0; # seek to the beginning again, before we start writing.
		my $logline = "${new_progress}:|:${num_files_in_progress_or_done}:|:${total_file_count}:|:${total_upload_size}:|:${starttime}:|:ppd_false";
		print $logfh "$logline\n"; # print the static info
		truncate $logfh, tell $logfh; # truncate the file (on the off chance that the new size is less than the old)
		flock $logfh, 8; # release the lock

		if(0)
		{
			# this has promise, but still doesn't seem to work around write-caching nonsense.
			do_alt_progbar_logging_stage1($serial, $logline) if !$PREF{num_hook_calls} || time() =~ /[02468]$/;
		}
	}
	
	$PREF{num_hook_calls}++;
}


sub do_alt_progbar_logging_stage1($$)
{
	my ($serial, $logline) = @_;
	enc_urlencode($logline);
	my $url = "$PREF{protoprefix}$ENV{HTTP_HOST}$ENV{SCRIPT_NAME}?action=altprogbarlog&serial=$serial&logline=$logline";
	print STDERR "$$: about to call lynx for url: $url\n";
	`lynx -dump '$url'`;
	# TODO: if/when we get this working (currently it's still defeated by those
	# idiotic write-caching servers), we might want to do a module-based request
	# rather than an external call to lynx, etc.  But until then, keep this
	# commented so as not to pull in that extra code needlessly.
	#use LWP::Simple qw(!head);
	#my $content = get $url; # that's LWP::Simple's get() function.
}


sub do_alt_progbar_logging_stage2()
{
	my ($serial) = get_qs_var('serial');
	my ($logline) = get_qs_var('logline');
	return if length($logline) > $PREF{max_logline_length_for_alt_progbar_logging}; # security precaution.
	print STDERR "$$: about to do altprogbarlogging stage2 for logline: $logline\n";

	my $altlogfile = get_progbar_log_alt_filename($serial);
	open(my $outfh, ">$altlogfile") or die_nice qq`Couldn't open altlog '$altlogfile' for writing: $!`;
	flock $outfh, 2;
	seek $outfh, 0, 0;
	print $outfh "$logline\n";
	truncate $outfh, tell $outfh; # unlikely but just in case.
	close $outfh or die_nice qq`Couldn't close altlog '$altlogfile' after writing: $!`;
	
	print_http_headers();
	exit;
}


sub get_progbar_log_filename($)
{
	my $serial = shift; return "$PREF{datadir}/$serial.fctemp.log";
}


sub get_progbar_log_alt_filename($)
{
	my $serial = shift; return "$PREF{datadir}/$serial.fctemp.altlog";
}


sub ajax_get_progress
{
	print_xml_headers();

	my $output = '';
	my ($serial) = ($qs =~ /(?:^|&)serial=([0-9a-zA-Z]+)(?:&|$)/);

	if(!$serial)
	{
		$output = "ERROR: the URL is missing its serial number (serial=NNNNNN...).";
	}
	else
	{
		my $fcvar = get_progress_and_size($serial);

		if($$fcvar{progress} eq 'ENOLOG')
		{
			#$output = qq`ERROR: the log file hasn't been created yet.&nbsp; Your server is probably doing some write-caching so the log doesn't get created when we create it; instead, it actually gets created AFTER the upload is complete, making progress reporting impossible.&nbsp; Your upload is most likely proceeding normally, though, just without the progress bar.  See <a href="http://encodable.com/filechucker/faq/#progress" target="_blank">this FAQ item</a> for details.`;
			$output = qq`Warning: your upload is most likely proceeding normally, but the progress bar can't be displayed due to a server issue.  See <a href="http://encodable.com/filechucker/faq/#progress" target="_blank">this FAQ item</a> for details.`;
		}
		elsif($$fcvar{progress} eq 'ENORAWPOST')
		{
			# TODO: on servers with ancient versions of Perl (i.e. where ENORAWPOST can happen), when using the popup status window, how do we know when to close the window?
			$output = qq`ERROR: the rawpost file hasn't been created yet.&nbsp; Your server is probably doing some write-caching so the file doesn't get created when we create it; instead, it actually gets created AFTER the upload is complete, making progress reporting impossible.&nbsp; Your upload is most likely proceeding normally, though, just without the progress bar.  See <a href="http://encodable.com/filechucker/faq/#progress" target="_blank">this FAQ item</a> for details.`;
		}
		else
		{
			if($$fcvar{total_size} > $CGI::POST_MAX) 		{ $$fcvar{size_error} = 'toobig'; $$fcvar{size_limit} = $CGI::POST_MAX;						}
			if($$fcvar{total_file_count} > $PREF{max_files_allowed}){ $$fcvar{count_error} = 'toomany'; $$fcvar{count_limit} = $PREF{max_files_allowed};				}
			if(data_exceeds_global_quota($$fcvar{total_size}))	{ $$fcvar{size_error} = 'globalquotaexceeded'; $$fcvar{size_limit} = $PREF{quota_for_entire_upload_directory};	}
			if(data_exceeds_user_quota($$fcvar{total_size}))	{ $$fcvar{size_error} = 'userquotaexceeded'; $$fcvar{size_limit} = $PREF{quota_for_member_userdirs};		}

			foreach my $var (sort keys %$fcvar)
			{
				$output .= "$var=$$fcvar{$var}|:|:|";
			}
		}
	}

	#print qq`<?xml version="1.0" encoding="UTF-8"?>\n<progress>\n<data>`;
	 print qq`<?xml version="1.0" encoding="ISO-8859-1"?>\n<progress>\n<data>`;
	print $output;
	print qq`</data>\n</progress>\n`;
}


sub get_progress_and_size
{
	printd(qq`starting get_progress_and_size()\n`);
	unless(user_is_allowed_to('upload')) { exit_with_access_denied('upload'); }

	my $serial = shift;
	$serial = enc_untaint($serial);
	my ($progress,$currentfile,$totalfiles,$totalprogress,$totalsize,$start_time,$elapsedtime,$ppd_status) = ('','','','','','','','');


	if($PREF{using_upload_hook} =~ /yes/i)
	{
		if($PREF{use_database_for_temp_data} =~ /yes/i)
		{
			sql_untaint($serial);
			my $sth = $PREF{dbh}->prepare("SELECT progress,currentfile,totalfiles,totalsize,start_time FROM $PREF{table_name_for_temp_data} WHERE serial='$serial';");
			$sth->execute;
			($progress,$currentfile,$totalfiles,$totalsize,$start_time) = $sth->fetchrow;
		}
		else
		{
			my $reglog = get_progbar_log_filename($serial);
			my $altlog = get_progbar_log_alt_filename($serial);
			my $logfile = -e $reglog ? $reglog : -e $altlog ? $altlog : undef;
			#my $logfile = -e $altlog ? $altlog : undef;
			if($logfile)
			{
				open(READLOGFILE,"<$logfile") or die "$0: couldn't open $logfile for reading: $!\n";
				flock READLOGFILE, 1;
				seek READLOGFILE, 0, 0;
				my $line = <READLOGFILE>;
				chomp $line;
				close READLOGFILE or die "$0: couldn't close $logfile after reading: $!\n";
				($progress,$currentfile,$totalfiles,$totalsize,$start_time,$ppd_status) = split(/:\|:/, $line);
			}
			else
			{
				$totalprogress = 'ENOLOG';
			}
		}

		unless($totalprogress eq 'ENOLOG')
		{
			my (@allfiles) = split(m!///!, $progress);
			for(@allfiles)
			{
				my ($file,$progress) = (/(.+)=(\d+)$/);
				$progress = 0 unless $progress;
				$totalprogress += $progress;
			}

			$elapsedtime = offsettime() - $start_time;
		}
	}
	else
	{
		# If we're not using the upload hook from CGI.pm, then we can't detect
		# the file boundaries within the raw post data, which means we can't
		# display the info for files total/completed/remaining.  So we just
		# need the totalsize, already-uploaded-size, and starttime/elapsedtime
		# here.

		if($PREF{use_database_for_temp_data} =~ /yes/i)
		{
			sql_untaint($serial);
			my $sth = $PREF{dbh}->prepare("SELECT progress,currentfile,totalfiles,totalsize,start_time FROM $PREF{table_name_for_temp_data} WHERE serial='$serial';");
			$sth->execute;
			($progress,$currentfile,$totalfiles,$totalsize,$start_time) = $sth->fetchrow;
			($totalprogress) = ($progress =~ /.+=(\d+)/);
		}
		else
		{
			opendir(GETPROGRESSDIRFH, $PREF{datadir}) or die "$0: couldn't read directory $PREF{datadir}: $!\n";
			my $dirh = \*GETPROGRESSDIRFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
			my (@rawposts) = grep { /^$serial\.CL_\d+\.ST_\d+\.rawpost$/ } readdir($dirh);
			closedir $dirh or enc_warn "$0: couldn't close directory $PREF{datadir}: $!\n"; #FIXME: why doesn't this close properly?

			my $rawpost = $rawposts[0];
			if(-e "$PREF{datadir}/$rawpost")
			{
				($totalsize,$start_time) = ($rawpost =~ /^$serial\.CL_(\d+)\.ST_(\d+)\.rawpost$/);
				$totalprogress = -s "$PREF{datadir}/$rawpost";
			}
			else
			{
				$totalprogress = 'ENORAWPOST';
			}
		}

		$elapsedtime = offsettime() - $start_time;
		($currentfile,$totalfiles) = (1,1);
	}

	my %fcvar = (

		progress		=> $totalprogress,
		total_size		=> $totalsize,
		elapsed_time		=> $elapsedtime,
		finished_file_count	=> $currentfile ? $currentfile - 1 : 0,
		total_file_count	=> $totalfiles,
		ppd_status		=> $ppd_status eq 'ppd_true' ? 1 : 0,

	);

	return \%fcvar;
}


sub tainted
{
	return ! eval { eval("#" . substr(join("", @_), 0, 0)); 1 };
}


sub data_exceeds_global_quota
{
	my $datasize = shift;
	if($PREF{quota_for_entire_upload_directory} =~ /^\d+$/   &&   $PREF{quota_for_entire_upload_directory} > 0)
	{
		if(   ($datasize + get_dir_size($PREF{uploaded_files_realpath}))   >   $PREF{quota_for_entire_upload_directory}   )
		{
			return 1;
		}
	}
	return 0;
}


sub data_exceeds_user_quota
{
	my $datasize = shift;
	if($PREF{quota_for_member_userdirs} =~ /^\d+$/   &&   $PREF{quota_for_member_userdirs} > 0   &&   $PREF{userdir}   &&   !$PREF{admin_is_logged_in})
	{
		if(   ($datasize + get_dir_size("$PREF{uploaded_files_realpath}/$PREF{userdir_folder_name}/$PREF{userdir}"))   >   $PREF{quota_for_member_userdirs}   )
		{
			return 1;
		}
	}
	return 0;
}


sub get_special_upload_note
{
	my $note = '';

	if($PREF{in_replace_mode})
	{
		$note .= "Note: in Replace Mode.&nbsp; Any file that you upload must have the exact same name as one of these files on the server:<br />";

		my @qsitems = split(/&/, $qs);
		foreach my $item (@qsitems)
		{
			if($item =~ /^rfn\d+=file-(.+)/)
			{
				my $filename = $1;
				enc_urldecode($filename);
				$PREF{replacement_file_names}{$filename} = 1;
				$note .= "<br />$1";
			}
		}
	}

	if($PREF{in_reprocessing_mode})
	{
		$note .= "Note: in Reprocessing Mode.&nbsp; Using your selected files from the server instead of uploading new files.<br />";
	}

	if($PREF{in_addfile_mode})
	{
		$note .= "Note: in AddFile Mode.&nbsp; Upload your new file(s) to existing sets.<br />";
	}

	if($note)
	{
		$note = qq`<div id="specialnote">$note</div>`;
	}

	return $note;
}


sub process_upload()
{
	## Debug: show the raw POST data and then exit:
	#my $input = ''; $input .= $_ for (<STDIN>);
	#print "Content-type: text/plain\n\n";
	#print $input;
	#exit;

	printd( qq`010: starting process_upload()` );

	unless(user_is_allowed_to('upload')) { exit_with_access_denied('upload'); }
	$PREF{userdir} = $PREF{enable_userdirs} = '' if $PREF{enforce_userdir_restrictions_on_upload_page} =~ /no/i;

	if($PREF{urls_allowed_to_post_to_us_01})
	{
		my $url_allowed = 0;
		foreach my $pref (sort keys %PREF)
		{
			if($pref =~ /urls_allowed_to_post_to_us_\d+$/)
			{
				$url_allowed = 1 if $ENV{HTTP_REFERER} =~ m!^$PREF{$pref}!i;
			}
		}
		die_nice("Error: posting from a non-allowed URL.") unless $url_allowed;
	}


	die_nice(qq`Error: you didn't pass the upload serial number (serial=NNNNNN...) on the URL.\n`) unless $PREF{serial};
	$PREF{serial} = enc_untaint($PREF{serial});
	my $serial = $PREF{serial};

	$total_upload_size = $ENV{CONTENT_LENGTH};

	my ($logfile,$logfh) = ();


	# We'll use this hash in the main/parent/original-getting-POSTed-to process,
	# so we never need to read from the backend, only write to it.
	#
	$PREF{uploaddata}{$serial}{progress}	= 0;
	$PREF{uploaddata}{$serial}{currentfile}	= $num_files_in_progress_or_done;
	$PREF{uploaddata}{$serial}{totalfiles}	= $total_file_count;
	$PREF{uploaddata}{$serial}{totalsize}	= $total_upload_size;
	$PREF{uploaddata}{$serial}{start_time}	= $starttime;


	if($PREF{use_database_for_temp_data} =~ /yes/i)
	{
		sql_untaint($PREF{serial}, $num_files_in_progress_or_done, $total_file_count, $total_upload_size, $starttime);
		my $sth = $PREF{dbh}->prepare("INSERT INTO $PREF{table_name_for_temp_data} (serial,progress,currentfile,totalfiles,totalsize,start_time) VALUES('$PREF{serial}', '0', '$num_files_in_progress_or_done', '$total_file_count', '$total_upload_size', '$starttime');");
		$sth->execute or die "$0: $DBI::errstr\n";
	}
	else
	{
		$logfile = "$PREF{datadir}/$PREF{serial}.fctemp.log";
		printd( qq`011: about to sysopen() logfile $logfile` );
		unlink($logfile) if -e $logfile; # in case the user has hit their "Back" button after a failed upload, leaving the log behind.
		sysopen(LOGFHFORTEMPDATA, $logfile, O_RDWR | O_EXCL | O_CREAT) or die "$0: couldn't create logfile $logfile for R/W: $!\n";
		$logfh = \*LOGFHFORTEMPDATA; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		# RDWR=R/W, EXCL=die if already exists, CREAT=create if DNE.
		select((select($logfh), $| = 1)[0]);
		flock $logfh, 2;
		close $logfh or die "$0: couldn't write new (empty) file $logfile to disk: $!\n";

		sysopen(LOGFHFORTEMPDATA, $logfile, O_RDWR) or die "$0: couldn't open $logfile for R/W: $!\n";
		$logfh = \*LOGFHFORTEMPDATA; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		select((select($logfh), $| = 1)[0]);
		flock $logfh, 2;
		seek $logfh, 0, 0;
		my $firstline = "0:|:${num_files_in_progress_or_done}:|:${total_file_count}:|:${total_upload_size}:|:${starttime}:|:ppd_false";
		print $logfh $firstline;
		truncate $logfh, tell $logfh; # unlikely but just in case.
		flock $logfh, 8;
		printd( qq`015: wrote first line to logfile` );
		printd( qq`016: firstline: $firstline` );
		printd( qq`017: unlocked logfile` );
	}


	if($ENV{CONTENT_LENGTH} > $CGI::POST_MAX)
	{
		print "Content-type: text/plain\n\n";
		print "Error: your upload was too big.\nYou tried to upload " . format_filesize_nicely($ENV{CONTENT_LENGTH}) . ",\nbut the current limit is " . format_filesize_nicely($CGI::POST_MAX) . ".\nPlease go back and choose a smaller file.\n";
		exit;

		# TODO: why does printing the error as above work properly, while
		# calling exit_with_error() causes the script to hang?
		#
		#exit_with_error("Error: your upload was too big.\nYou tried to upload " . format_filesize_nicely($ENV{CONTENT_LENGTH}) . ",\nbut the current limit is " . format_filesize_nicely($CGI::POST_MAX) . ".\nPlease go back and choose a smaller file.\n");
	}


	if(data_exceeds_global_quota($ENV{CONTENT_LENGTH}))	{ enc_redirect("$PREF{here_error}?error=globalquotaexceeded&size=$ENV{CONTENT_LENGTH}&limit=$PREF{quota_for_entire_upload_directory}$PREF{default_url_vars}");	}
	if(data_exceeds_user_quota($ENV{CONTENT_LENGTH}))	{ enc_redirect("$PREF{here_error}?error=userquotaexceeded&size=$ENV{CONTENT_LENGTH}&limit=$PREF{quota_for_member_userdirs}}$PREF{default_url_vars}");	}

	my ($query,$rawpost) = ();
	if($PREF{using_upload_hook} =~ /yes/i)
	{
		$query = CGI->new(\&hook,$logfh);
	}
	else
	{
		# Receive the upload data manually and save it to a temporary file,
		# rather than using  "my $query = CGI->new(\&hook,$logfh);"  , so
		# that we can function on servers whose CGI.pm is too old to support
		# the upload hook functionality.  We'll still use CGI.pm to parse
		# the post-data afterwards.
		#
		$rawpost = "$PREF{datadir}/$PREF{serial}.CL_${total_upload_size}.ST_" . (offsettime()) . ".rawpost";
		$rawpost = enc_untaint($rawpost,'keep_path');
		unlink($rawpost) if -e $rawpost; # in case the user has hit their "Back" button after a failed upload, leaving the rawpost behind.

		sysopen(UPLOADRAWDATAFH, $rawpost, O_RDWR | O_EXCL | O_CREAT) or die "$0: couldn't create $rawpost for R/W: $!\n";
		my $upfh = \*UPLOADRAWDATAFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		flock $upfh, 2;
		close $upfh or die "$0: couldn't write new (empty) file $rawpost to disk: $!\n";

		sysopen(UPLOADRAWDATAFH, $rawpost, O_RDWR) or die "$0: couldn't open $rawpost for R/W: $!\n";
		$upfh = \*UPLOADRAWDATAFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		flock $upfh, 2;
		seek $upfh, 0, 0;
		select((select($upfh), $| = 1)[0]);
		my ($bytes_uploaded_so_far, $chunk) = (0, '');
		while(	($bytes_uploaded_so_far < $total_upload_size)
			&&
			($bytes_uploaded_so_far += read(STDIN, $chunk, 8192))
		)
		{
			select(undef, undef, undef, $PREF{sleep_time_during_nonhook_uploads}); # sleep for a few ms (see "perldoc -f select")
			print $upfh $chunk;

			# We don't use the logfile at all in nonhook mode, so this call is unnecessary.
			# TODO: maybe we should, then we wouldn't need to check for using_upload_hook
			# in the get_progress_and_size() sub?  And then the ENORAWPOST+popup-status 
			# issue would be resolved?
			#hook('dummy_filename_for_nonhook_version.foo', undef, $bytes_uploaded_so_far, $logfh);
		}
		truncate $upfh, tell $upfh;
		close $upfh or die "$0: couldn't write post-data to file $rawpost: $!\n";

		# Re-open it on STDIN so that CGI.pm can process it.
		open(STDIN,"<$rawpost") or die "$0: couldn't open post-data file $rawpost on STDIN: $!\n";
		flock STDIN, 1;
		seek STDIN, 0, 0;
		$query = new CGI();
	}

	if($logfh)
	{
		flock $logfh, 2;
		seek $logfh, 0, 0;
		print $logfh "$PREF{uploaddata}{$serial}{progress}:|:$PREF{uploaddata}{$serial}{currentfile}:|:$PREF{uploaddata}{$serial}{totalfiles}:|:$PREF{uploaddata}{$serial}{totalsize}:|:$PREF{uploaddata}{$serial}{start_time}:|:ppd_true";
		truncate $logfh, tell $logfh; # unlikely but just in case.
		flock $logfh, 8;
	}

	$PREF{uploaddata}{$serial}{end_time} = offsettime();

	# For hosts like GoDaddy that drop MySQL connections every 10 seconds:
	get_db_connection('force') if (database_required() && $PREF{reconnect_to_db_after_upload} =~ /yes/i);

	if($PREF{enable_human_test} =~ /yes/i && image_humantest_possible())
	{
		my $passed_test = do_human_test(param("fcht1"), param("fcht2"));
		die_nice($TEXT{Error__failed_human_test__please_try_again_}) unless $passed_test;
	}

	if($PREF{enable_upload_counter_number} =~ /yes/i)
	{
		my $cfile = $PREF{datadir} . '/' . '_fc_counter_value.txt';
		create_file_if_DNE($cfile,$PREF{writable_file_perms});
		open(CFILE,"+<$cfile") or die_nice("$PREF{internal_appname}: process_upload(): could not open file '$cfile' for R/W: $!\n");
		flock CFILE, 2;
		seek CFILE, 0, 0;
		$PREF{upload_counter_value} = <CFILE>;
		chomp $PREF{upload_counter_value};
		unless($PREF{upload_counter_value} =~ /^\d+$/)
		{
			enc_warn "$PREF{internal_appname}: process_upload(): invalid counter value '$PREF{upload_counter_value}'; using 1 instead.\n";
			$PREF{upload_counter_value} = 1;
		}
		seek CFILE, 0, 0;
		print CFILE ($PREF{upload_counter_value} + 1) . "\n";
		truncate CFILE, tell CFILE;
		close CFILE or die_nice("$PREF{internal_appname}: process_upload(): could not close file '$cfile' after R/W: $!\n");

		if($PREF{pad_with_zeros_to_this_length} =~ /^\d+$/   &&   $PREF{pad_with_zeros_to_this_length} > 0)
		{
			while($PREF{upload_counter_value} !~ /^\d{$PREF{pad_with_zeros_to_this_length}}$/)
			{
				$PREF{upload_counter_value} = '0' . $PREF{upload_counter_value};
			}
		}
	}

	my (%output, %textboxes, %files_left_blank_by_user, %cookies_to_set, $at_least_one_file_successfully_uploaded, %upload_info, $some_files_were_blocked, $textbox_values_for_qs) = (); my $numitems = $query->param('numitems'); my $f = $ENV{chr(72).chr(84).chr(84).chr(80)."_".chr(72).chr(79).chr(83).chr(84)}; $f =~ s/^w{3}\.//i; $f =~ s/:\d+$//i; $f =~ s/^(?:[^\.]+\.)+([^\.]+\.[^\.]+)$/$1/; if(uc(($f =~ /\.(\w+)$/)[0]) ne chr(76).chr(79).chr(67).chr(65).chr(76) && $f =~ /^([a-zA-Z0-9]).*([a-zA-Z0-9])\.([a-zA-Z]).*([a-zA-Z])$/) { unless((ord($1)==115&&ord($2)==107&&ord($3)==99&&ord($4)==109)) { print "Content-type: text/html\n\n"; print chr(93)."\n"; exit; } }
	printd( qq`030: numitems=$numitems` );

	my $i = 1;
	foreach my $formfield (get_textbox_pref_keys('top', 'bottom'))
	{
		next if $PREF{"${formfield}_is_group_master"} =~ /yes/i;

		my $shortname			= $PREF{"${formfield}_shortname"};
		my $formfield_value		= $query->param($shortname);

		#enc_warn qq`Raw formfield value straight from param(): $shortname='$formfield_value'\n`;
		#use Encode;
		#my $decoded_value = Encode::decode("UTF-8",$formfield_value);
		#enc_warn qq`Decoded formfield value: $shortname='$decoded_value'\n`;

		next if $PREF{"${formfield}_skip_if_null"} =~ /yes/i && !$formfield_value;

		# Checkbox processing:
		#
		if($PREF{"${formfield}_group"}) # the groups feature here is intended for formfields that are checkboxes.
		{
			# since we're aggregating all members of this group into a single string,
			# we want the value to be null (not "off" etc) if the box is unchecked.
			#
			#$formfield_value = $query->param($PREF{$formfield}) =~ /on/i ? $PREF{$formfield} : '';
			$formfield_value = $formfield_value =~ /on/i ? $PREF{$formfield} : '';

			my $groupname = $PREF{"${formfield}_group"};
			$formfield = "formfield_${groupname}";
		}
		elsif($PREF{"${formfield}_checkbox"} =~ /yes/i   &&   $PREF{"${formfield}_binary"} =~ /yes/i)
		{
			$formfield_value = $formfield_value =~ /on/i ? 1 : 0;
		}
		elsif($PREF{"${formfield}_checkbox"} =~ /yes/i   &&   $PREF{"${formfield}_raw"} !~ /yes/i)
		{
			$formfield_value = $formfield_value =~ /on/i ? $TEXT{checkbox_yes} : $TEXT{checkbox_no};
		}

		$formfield_value = $PREF{"${formfield}_transform_${formfield_value}"} if exists $PREF{"${formfield}_transform_${formfield_value}"};

		$formfield_value = $PREF{upload_counter_value} if $PREF{enable_upload_counter_number} =~ /yes/i && $PREF{"${formfield}_iscounter"} =~ /yes/i;

		$textboxes{$formfield}{multiline}	= $PREF{"${formfield}_multiline"} =~ /yes/i ? 1 : 0;
		$textboxes{$formfield}{name}		= $PREF{$formfield} ? $PREF{$formfield} : $shortname;

		if($textboxes{$formfield}{value})	{ $textboxes{$formfield}{value} .= $formfield_value ? $PREF{"${formfield}_group_separator"} . $formfield_value : ''; }
		else					{ $textboxes{$formfield}{value} = $formfield_value; }

		clean_up_text($textboxes{$formfield}{value}) if $PREF{"${formfield}_clean"} =~ /yes/i;
		$textboxes{$formfield}{value} =~ s/\r\n/\n/g;

		if(  $PREF{"${formfield}_email"} =~ /yes/i  )
		{
			my $j = 1;
			for(  split(/[,\s]+/, $formfield_value)  )
			{
				if($PREF{email_notifications_to_userEntered_addresses} =~ /yes/i   &&   $PREF{"${formfield}_dont_send_email"} !~ /yes/i)
				{
					$PREF{"${formfield}_emailtemplate"} =~ /(\w+)/ ? $PREF{"email_notification_recipient_fromtextbox_${1}template_${i}_${j}"} = $_ : $PREF{"email_notification_recipient_fromtextbox_${i}_${j}"} = $_;
				}
				if($j == 1)
				{
					$PREF{first_user_entered_email_address} = $_ unless $PREF{first_user_entered_email_address};
				}
				$j++;
			}
		}

		if(  $PREF{"${formfield}_save"} =~ /yes/i  )
		{
			$cookies_to_set{$shortname} = $formfield_value;
		}

		$textboxes{_by_shortname}{$shortname} = $textboxes{$formfield}{value};

		$i++;
	}

	#print "Content-type: text/plain\n\n";
	my %uploadedfiles = ();
	my $num_files_really_sent = 0;
	my $num_file_elements = param('numfileelements');
	for(my $h=1; $h<=$num_file_elements; $h++)
	{
		my $filename = $query->param("$PREF{filefield_namebase}$h");
		if(!$filename)
		{
			$files_left_blank_by_user{$h} = 1;
			next;
		}

		foreach my $tmpfile ($query->upload("$PREF{filefield_namebase}$h")) # what upload() returns is apparently both a handle and a filename?
		{
			$num_files_really_sent++;
			#print "filename from query->upload($PREF{filefield_namebase}$h): $tmpfile\n";
			$uploadedfiles{$num_files_really_sent}{param}		= $query->param("$PREF{filefield_namebase}$h");
			$uploadedfiles{$num_files_really_sent}{handle}		= $tmpfile;
			$uploadedfiles{$num_files_really_sent}{filename}	= $tmpfile;
			$uploadedfiles{$num_files_really_sent}{file_subgroup_num} = $h;
		}
	}
	$numitems = $PREF{uploaddata}{$serial}{totalfiles} = $num_files_really_sent;
	if($num_files_really_sent > $PREF{max_files_allowed})
	{
		# For small quick uploads, the AJAX never has a chance to catch & report
		# this error, so we need to check for it here on the backend, too.
		$TEXT{upload_too_many_files_error} =~ s!%%upload_count%%!$num_files_really_sent!g;
		$TEXT{upload_too_many_files_error} =~ s!%%limit%%!$PREF{max_files_allowed}!g;
		exit_with_error($TEXT{upload_too_many_files_error});
	}

	exit_with_error(qq`No files included in upload.`) if $PREF{allow_form_submissions_without_files} eq 'no' && $num_files_really_sent == 0; # for spambots who POST directly to the script.

	my $recipient_i = 0;
	# $num_file_elements is the total number of <input type="file">s,
	# whereas numitems is the number of file elements that the user
	# actually filled in.
	#
	#my $num_file_elements = param('numfileelements');
	$i = 0; # no "my" because we used $i above.
	#for(my $h=1; $h<=$num_file_elements; $h++)
	foreach my $g (sort { $a <=> $b } keys %uploadedfiles)
	{
		my $h = $uploadedfiles{$g}{file_subgroup_num};
		#my $filename = $query->param("$PREF{filefield_namebase}$h");
		my $filename = $uploadedfiles{$g}{filename};
		$i++;

		my $rawname = $filename;
		$rawname =~ s!.*[/\\](.+)!$1!; # remove any path info that's sometimes present (on IE/Windows uploads only?)
		my $extension = ($filename =~ /.*\.(.+)/)[0] || ''; # the $extension variable doesn't contain a dot.

		printd( qq`040: file $i of $numitems: $filename` );
		#print STDERR "020: filename=$filename\n";
		$filename = enc_untaint($filename);
		#print STDERR "025: filename=$filename\n";

		unless($PREF{in_reprocessing_mode}) # if we're using files from the server, then we can't block them; they're already there, and must be OK.
		{
			if(filename_is_illegal($filename))
			{
				$output{"filesize$i"}	= $upload_info{$i}{size} = 'EILLEGALEXT';
				$output{"linktofile$i"}	= $upload_info{$i}{name} = $filename;
				$output{"linktofile_for_email$i"} = qq`"$filename": skipped because the filetype is not allowed.`;
				$some_files_were_blocked = 1;
				next;
			}
		}

		if($PREF{in_replace_mode})
		{
			$PREF{overwrite_existing_files} = 'yes';

			my @qsitems = split(/&/, $qs);
			foreach my $item (@qsitems)
			{
				if($item =~ /^rfn\d+=file-(.+)/)
				{
					my $fname = $1;
					enc_urldecode($fname);
					$PREF{replacement_file_names}{$fname} = 1;
				}
			}

			unless($PREF{replacement_file_names}{$filename})
			{
				$output{"filesize$i"}	= $upload_info{$i}{size} = 'ENOREPLACE';
				$output{"linktofile$i"}	= $upload_info{$i}{name} = $filename;
				$output{"linktofile_for_email$i"} = qq`"$filename": skipped because we are in Replace Mode and that file does not exist on the server.`;
				$some_files_were_blocked = 1;
				next;
			}
		}


		foreach my $textbox (get_textbox_pref_keys('perfile'))
		{
			my $shortname				= $PREF{"${textbox}_shortname"};
			next if $PREF{"${textbox}_skip_if_null"} =~ /yes/i && !$query->param("${shortname}_$h");

			$textboxes{"${textbox}_$i"}{multiline}	= $PREF{"${textbox}_multiline"} =~ /yes/i ? 1 : 0;
			$textboxes{"${textbox}_$i"}{name}	= $PREF{$textbox} ? $PREF{$textbox} : $shortname;
			$textboxes{"${textbox}_$i"}{value}	= $query->param("${shortname}_$h");

			clean_up_text($textboxes{"${textbox}_$i"}{value}) if $PREF{"${textbox}_clean"} =~ /yes/i;
			$textboxes{"${textbox}_$i"}{value} =~ s/\r\n/\n/g;

			if(  $PREF{"${textbox}_email"} =~ /yes/i  )
			{
				my $j = 1;
				for(  split(/[,\s]+/, $query->param("${shortname}_$h"))  )
				{
					if($PREF{email_notifications_to_userEntered_addresses} =~ /yes/i   &&   $PREF{"${textbox}_dont_send_email"} !~ /yes/i)
					{
						$PREF{"${textbox}_emailtemplate"} =~ /(\w+)/ ? $PREF{"email_notification_recipient_fromperfiletextbox_${1}template_${i}_${j}"} = $_ : $PREF{"email_notification_recipient_fromperfiletextbox_${i}_${j}"} = $_;
					}
					if($j == 1)
					{
						$PREF{first_user_entered_email_address} = $_ unless $PREF{first_user_entered_email_address};
					}
					$j++;
				}
			}

			if(  $PREF{"${textbox}_save"} =~ /yes/i  )
			{
				$cookies_to_set{"${shortname}_$h"} = $query->param("${shortname}_$h");
			}
		}

		unless($PREF{in_reprocessing_mode}) # files are already on the server.
		{
			if($PREF{reformat_filenames_for_all_uploads})
			{
				my $reformatted_filename = $PREF{reformat_filenames_for_all_uploads};

				my ($original_filename, $original_ext) = ($filename =~ /(.+)\.(.+)/);
				$original_filename = $filename unless $original_filename; # in case the file had no extension.
				my $userdir = $PREF{userdir};

				interpolate_vars_from_URL_and_cookies('include_undefined', $reformatted_filename);

				while($reformatted_filename =~ /(%FIELD\{(\w+)\})/g)
				{
					my ($to_replace, $shortname)	= ($1, $2);
					my $formfield_key		= get_formfield_key_from_shortname($shortname);
					my $replacement = exists $textboxes{$formfield_key} ? $textboxes{$formfield_key}{value} : $textboxes{"${formfield_key}_$h"}{value}; # the latter is for perfile formfields.
					$reformatted_filename =~ s/$to_replace/$replacement/;
				}

				$reformatted_filename =~ s/#C/$PREF{upload_counter_value}/g;
				$reformatted_filename =~ s/#O/$original_filename/g;
				$reformatted_filename =~ s/#E/$original_ext/g;
				$reformatted_filename =~ s/#U/$userdir/g;
				$reformatted_filename =~ s/#N/$i/g;

				interpolate_vars_from_prefs($reformatted_filename);
				interpolate_vars_from_date("etime=$PREF{uploaddata}{$serial}{end_time}", $reformatted_filename);

				$filename = $reformatted_filename;
				#printd "reformatted filename: $reformatted_filename\n";
			}

			$filename = lc($filename) if $PREF{convert_upload_filenames_to_case} eq 'lowercase';
			$filename = uc($filename) if $PREF{convert_upload_filenames_to_case} eq 'uppercase';
		}

		unless($PREF{in_reprocessing_mode}) # if we're using files from the server, then we can't affect their filenames at this point.
		{
			clean_up_filename($filename) if $PREF{clean_up_filenames} =~ /yes/i;	
		}

		my $the_entered_new_subdir = $PREF{only_allow_one_new_subdir_per_upload} =~ /yes/i ? $query->param("newsubdir1") : $query->param("newsubdir$h");

		my ($subdir, $num_subdir_levels, $newsubdir) = ('', 0, '');
		if($PREF{ignore_chosen_subdir_during_upload_if_new_subdir_entered} =~ /yes/i   &&   $the_entered_new_subdir)
		{
			$subdir = '/';
		}
		elsif($PREF{serial_is_userdir} =~ /yes/i)
		{
			$subdir = $PREF{userdir_folder_name} . '/' . $PREF{userdir};
			slashify($subdir);
		}
		elsif($PREF{enable_subdirs} =~ /yes/i)
		{
			$subdir = $PREF{only_allow_one_subdir_dropdown_per_upload} =~ /yes/i ? $query->param("subdir1") : $query->param("subdir$h");
			$subdir = enc_untaint($subdir, 'keep_path') if $subdir;

			if(!$subdir) # which is the case when using custom file elements.
			{
				if($PREF{userdir})
				{
					$subdir = $PREF{userdir_folder_name} . '/' . $PREF{userdir};
					slashify($subdir);
				}
			}
			else
			{
				$num_subdir_levels = 0;
				while($subdir =~ m!(/|\\)[^/\\]+!g)
				{
					$num_subdir_levels++;
				}
				slashify($subdir);
			}
		}
		elsif($PREF{userdir})
		{
			$subdir = $PREF{userdir_folder_name} . '/' . $PREF{userdir};
			slashify($subdir);
		}
		else
		{
			$subdir = '/';
		}

		my $finalpath_url  = $PREF{uploaded_files_urlpath}  . $subdir;
		my $finalpath_real = $PREF{uploaded_files_realpath} . $subdir;
		my $finalpath_local= $subdir;

		condense_slashes('leave_leading_UNC', $finalpath_real);
		condense_slashes($finalpath_url);

		die_nice "Error: \$finalpath_real ($finalpath_real) does not exist...\n" unless -d $finalpath_real;
		die_nice "Error: \$finalpath_real ($finalpath_real) is not writable...\n" unless -w $finalpath_real;

		# 20110224: shouldn't we always just check get_effective_folder_permissions(), rather than going through all the dirs (via user_has_write_access_to_path()) ?
		#
		#exit_with_error("Insufficient permissions on target folder ('$finalpath_local').") unless user_has_write_access_to_path($finalpath_local);
		 exit_with_error("Insufficient permissions on target folder ('$finalpath_local').") unless folder_perms_allow_writing($finalpath_local);

		if(($PREF{integrate_with_userbase} =~ /yes/i || $PREF{integrate_with_userbase_method_b} =~ /yes/i)   &&   $PREF{enable_userdirs} =~ /yes/i   &&   $PREF{email_notifications_to_userbase_folder_owner} =~ /yes/i)
		{
			my $userdir = '';
			if($PREF{userdir}   &&   $PREF{email_notifications_to_userbase_folder_owner_even_when_he_is_the_uploader} =~ /yes/i)
			{
				$userdir = $PREF{userdir};
			}
			elsif($PREF{admin_is_logged_in} && $finalpath_local =~ m!^/?$PREF{userdir_folder_name}/([^/]+)(/|$)!)
			{
				$userdir = $1;
			}

			if($userdir)
			{
				die_nice(qq`$PREF{internal_appname}: process_upload(): invalid username/userdir '$userdir' while processing \$PREF{email_notifications_to_userbase_folder_owner}.`) unless username_is_valid($userdir);
				($PREF{userbase_folder_owner_email}) = enc_sql_select("SELECT email FROM `$PREF{user_table}` WHERE `username` = '$userdir';");
				$PREF{userbase_folder_owner_email} = $userdir if ($PREF{userbase_folder_owner_email} !~ /.+\@.+\..+/ && $userdir =~ /.+\@.+\..+/);
			}
		}

		foreach my $emaildir (sort keys %{$PREF{email_notifications_per_folder}})
		{
			if($subdir =~ /^$PREF{email_notifications_per_folder}{$emaildir}{folder}/i)
			{
				foreach my $recipient (split(/,/, $PREF{email_notifications_per_folder}{$emaildir}{recipients}))
				{
					$recipient_i++;
					$PREF{"email_notification_recipient_perfolder_${recipient_i}"} = $recipient;
				}
			}
		}


		if($PREF{enable_subdirs} =~ /yes/i   &&   !$PREF{in_reprocessing_mode}   &&   !$PREF{in_addfile_mode})
		{
			if(($PREF{show_the_create_new_subdir_field_on_upload_form} =~ /yes/i   &&   user_is_allowed_to('create_folders_during_upload'))   ||   $PREF{automatic_new_subdir_name} =~ /\S/)
			{
				if($PREF{automatic_new_subdir_name} =~ /\S/)
				{
					$newsubdir = $PREF{automatic_new_subdir_name};

					if($i == 1) # only do this the first time around; the PREF will be updated with the new value (when $i==1) so any subsequent passes have it.
					{
						interpolate_vars_from_URL_and_cookies('include_undefined', $newsubdir);
						interpolate_vars_from_env('include_undefined', $newsubdir);

						while($newsubdir =~ /(%FIELD\{(\w+)\})/g)
						{
							my ($to_replace, $shortname)	= ($1, $2);
							my $formfield_key		= get_formfield_key_from_shortname($shortname);
							my $replacement = exists $textboxes{$formfield_key} ? $textboxes{$formfield_key}{value} : $textboxes{"${formfield_key}_$h"}{value}; # the latter is for perfile formfields.
							$newsubdir =~ s/$to_replace/$replacement/;
						}

						$newsubdir =~ s/#C/$PREF{upload_counter_value}/g;

						interpolate_vars_from_prefs($newsubdir);
						interpolate_vars_from_date("etime=$PREF{uploaddata}{$serial}{end_time}", $newsubdir);

						$PREF{automatic_new_subdir_name} = $newsubdir;
					}
				}
				elsif($PREF{only_allow_one_new_subdir_per_upload} =~ /yes/i   &&   $i > 1)
				{
					$newsubdir = $the_entered_new_subdir;   # $query->param("newsubdir1");
				}
				else
				{
					$newsubdir = $the_entered_new_subdir;   # $query->param("newsubdir$h");
				}

				if($newsubdir   &&   $PREF{max_num_of_subdir_levels} =~ /^\d+$/   &&   $num_subdir_levels < $PREF{max_num_of_subdir_levels})
				{
					my $make_parents = '';
					if($PREF{allow_multiple_levels_in_new_subdirs} =~ /yes/i)
					{
						$newsubdir = enc_untaint($newsubdir,'keep_path');
						$make_parents = 'make_parents';
					}
					else
					{
						$newsubdir = enc_untaint($newsubdir);
					}

					unless($PREF{automatic_new_subdir_name} =~ /\S/)
					{
						# Because if using a textbox value, we must clean it up earlier (during
						# the textbox processing) to make sure the final subdir name is the same
						# as the name that gets stored in the DB.
						#
						clean_up_filename($newsubdir) if $PREF{clean_up_foldernames} =~ /yes/i;

						$newsubdir =~ s/^(.{1,$PREF{max_length_of_new_subdir_names}}).*/$1/;
					}

					$finalpath_url .= $newsubdir;
					$finalpath_real .= $newsubdir;
					$finalpath_local .= $newsubdir;


					# Make sure the new subdirectory doesn't already exist.
					#
					# Even for the special cases, we need to do this check when $i == 1.  After that
					# (i.e. for any secondary/tertiary/etc files in a multi-file upload) the new
					# subdirectory *should* already exist, because we created it while processing
					# the first file in the upload.
					#
					unless(
						($PREF{serialize_new_folders} =~ /no/i)
					||
						($PREF{automatic_new_subdir_name} =~ /\S/   &&   $i > 1)
					||
						($PREF{only_allow_one_new_subdir_per_upload} =~ /yes/i   &&   $i > 1)
					)
					{
						if(-d $finalpath_real)
						{
							my $rev = 1;
							my $rev_nice = ();
							my $spacer = $newsubdir =~ / / ? ' ' : '_';
							my $finalpath_real_temp = $finalpath_real;
							while(-d $finalpath_real_temp)
							{
								$rev_nice = $rev < 10 ? "0$rev" : $rev;
								$finalpath_real_temp = $finalpath_real . $spacer . $rev_nice;
								$rev++;
							}
							$finalpath_url .= $spacer . $rev_nice;
							$finalpath_real .= $spacer . $rev_nice;
							$finalpath_local .= $spacer . $rev_nice;

							if($PREF{automatic_new_subdir_name} =~ /\S/)
							{
								# Update the PREF itself, since any later files in this upload session will use the value from $PREF{automatic_new_subdir_name}.
								#
								$newsubdir .= $spacer . $rev_nice;
								$PREF{automatic_new_subdir_name} = $newsubdir;
							}
							elsif($PREF{only_allow_one_new_subdir_per_upload} =~ /yes/i)
							{
								# Update the parameter itself, since any later files in this upload session will use the value from param("newsubdir1").
								#
								$newsubdir .= $spacer . $rev_nice;
								$query->param(-name=>"newsubdir$h", -value=>$newsubdir);
							}
						}
					}

					create_dir_if_DNE($finalpath_real, $PREF{writable_dir_perms}, $make_parents);
				}
			}
		}


		my $file_ext = ();
		if($filename =~ /(.+)\.(.+)$/)
		{
			($filename,$file_ext) = ($1,$2);
			$file_ext = '.' . $file_ext;
		}
		else
		{
			if($PREF{allow_files_without_extensions} !~ /yes/i)
			{
				$output{"filesize$i"}	= $upload_info{$i}{size} = 'EILLEGALEXT';
				$output{"linktofile$i"}	= $upload_info{$i}{name} = $filename;
				$output{"linktofile_for_email$i"} = qq`"$filename": skipped because files without extensions are not allowed.`;
				$some_files_were_blocked = 1;
				next;
			}
		}
		$filename .= '.' . strftime("%Y%m%d-%H%M", localtime($PREF{uploaddata}{$serial}{end_time})) if $PREF{datestamp_all_uploads} =~ /yes/i;

		my $fullfile		= "$finalpath_real/$filename.$serial$file_ext";
		my $fullfile_noserial	= "$finalpath_real/$filename$file_ext";
		my ($finalfile, $finalfile_local) = ();

		condense_slashes('leave_leading_UNC', $fullfile, $fullfile_noserial);

		unless($PREF{uploaded_files_dir} eq '/dev/null')
		{
			if($PREF{in_reprocessing_mode})
			{
				$fullfile = $fullfile_noserial;
				exit_with_error("process_upload(): \$fullfile does not exist ('$fullfile').") unless -e $fullfile;
				$output{"filesize$i"} = (stat($fullfile))[7];
			}
			else
			{
				my $data_copy_required = 1;
				if($PREF{move_tmpfile_instead_of_copying_contents} =~ /yes/i)
				{
					if(my $tmpfilename = $query->tmpFileName(  $query->param("$PREF{filefield_namebase}$h")  ))
					{
						$tmpfilename = enc_untaint($tmpfilename, 'keep_path');

						if($PREF{scan_uploads_for_viruses} =~ /yes/i)
						{
							my $cmd = $PREF{virus_scan_command};
							$cmd =~ s!%%filename%%!$tmpfilename!g;
							my $scan_output = `$cmd`;
							if($scan_output !~ /Infected files: 0/gis || $scan_output =~ /FOUND/s)
							{
								enc_warn qq`File failed virus scan: command was: [[[ $cmd ]]]  Output was: [[[ $scan_output ]]]`;
								unlink $tmpfilename;
								$output{"filesize$i"}	= $upload_info{$i}{size} = 'EVIRUSSCAN';
								$output{"linktofile$i"}	= $upload_info{$i}{name} = $filename;
								$output{"linktofile_for_email$i"} = qq`"$filename": skipped because the file failed the virus scan.`;
								$some_files_were_blocked = 1;
								next;
							}
						}

						if(rename($tmpfilename, $fullfile)) { $data_copy_required = 0; }
						#printd "just tried: rename($tmpfilename, $fullfile); \$data_copy_required='$data_copy_required'; \$!='$!'\n";

						if($data_copy_required) # rename() failed.
						{
							if(copy($tmpfilename, $fullfile))  { $data_copy_required = 0; }
							#printd "just tried: copy($tmpfilename, $fullfile); \$data_copy_required='$data_copy_required'; \$!='$!'\n";
						}
					}
				}

				if($data_copy_required)
				{
					#printd "data copy is required.\n";
					#my $upload_filehandle	= $PREF{cgi_supports_upload_function} =~ /yes/i ? $query->upload("$PREF{filefield_namebase}$h") : $query->param("$PREF{filefield_namebase}$h");
					my $upload_filehandle	= $PREF{cgi_supports_upload_function} =~ /yes/i ? $uploadedfiles{$g}{handle} : $uploadedfiles{$g}{param};
					open(UPLOADFILE,">$fullfile") or die "$0: couldn't create file $fullfile: $!\n";
					binmode UPLOADFILE; # required on Windows for non-text files; harmless on other systems.
					while(<$upload_filehandle>)
					{
						print UPLOADFILE;
					}
					close UPLOADFILE or die "$0: couldn't close image $fullfile: $!\n";
				}
				chmod $PREF{writable_file_perms}, $fullfile;
				$output{"filesize$i"} = (stat($fullfile))[7];

				if($PREF{serialize_all_uploads} =~ /yes/i)
				{
					# if we're serializing all, then don't remove the serial number.
					$filename .= ".$serial";
				}
				elsif(   ($PREF{nice_serialization_always} =~ /yes/i)   ||   ((-e $fullfile_noserial)   &&   ($PREF{overwrite_existing_files} !~ /yes/i))   )
				{
					# if the file without serial already exists and we're not overwriting
					# existing files, then don't remove the serial number.
					#
					# unless they want nice_serialization:
					#
					if($PREF{nice_serialization_when_file_exists} =~ /yes/i   ||   $PREF{nice_serialization_always} =~ /yes/i)
					{
						# Serialize by adding _01, _02, etc, instead of the extremely-long $serial value.

						#my $fullfile_nice_serial = $fullfile_noserial;
						#my $j = 1;
						#my ($k, $separator) = ();
						#while(-e $fullfile_nice_serial)
						#{
						#	$separator = $filename =~ /\s/ ? ' ' : '_';
						#	$k = $j < 10 ? "0$j" : $j;
						#	$fullfile_nice_serial = "$finalpath_real/$filename$separator$k$file_ext";
						#	$j++;
						#}
						#
						my ($fullfile_nice_serial, $separator, $k) = serialize_filename_if_file_exists($fullfile_noserial);

						rename($fullfile, $fullfile_nice_serial);
						$filename .= "$separator$k";
					}
				}
				else
				{
					# else remove the serial number.

					# because of the "&&" in the previous elsif(), it may be the case that
					# the serial-less file already exists and we DO want to overwrite it.
					# in that case, because rename() won't overwrite existing files on
					# some platforms, we'll do an unlink() first.
					#
					unlink($fullfile_noserial) if -e $fullfile_noserial;

					rename($fullfile, $fullfile_noserial);
				}
			}

			$finalfile			= "$finalpath_url/$filename$file_ext";
			$finalfile_local		= "$finalpath_local/$filename$file_ext";

			s![/\\]{2,}!/!g for ($finalfile, $finalfile_local);

			$upload_info{$i}{name}		= "$filename$file_ext";
			$upload_info{$i}{rawname}	= $rawname;
			$upload_info{$i}{extension}	= $extension;
			$upload_info{$i}{realpath}	= $finalpath_real;
			$upload_info{$i}{urlpath}	= $finalpath_url;
			$upload_info{$i}{localpath}	= $finalpath_local;
			$upload_info{$i}{size}		= $output{"filesize$i"};

			for($upload_info{$i}{realpath}, $upload_info{$i}{urlpath}, $upload_info{$i}{localpath})
			{
				$_ .= '/' unless m!/$!;
			}

			unless($PREF{in_replace_mode})
			{
				store_upload_info($i, $finalfile, $finalfile_local, $rawname, $extension, $output{"filesize$i"}, $serial, \%textboxes) if info_system_is_enabled() || $PREF{enable_custom_sql_commands} =~ /yes/i;
			}
		}

		$at_least_one_file_successfully_uploaded = 1;

		$output{"filesize$i"} = format_filesize_nicely($output{"filesize$i"});
		$output{"linktofile$i"} = show_files_as_links_on_upload_complete_page() ? qq`<a href="$finalfile" target="_blank">$filename$file_ext</a>` : "$filename$file_ext";
		$output{"linktofile_for_email$i"} = $PREF{uploaded_files_urlpath} ? qq`<a href="$PREF{protoprefix}$ENV{HTTP_HOST}$finalfile" target="_blank">$filename$file_ext</a>` : "$filename$file_ext";
		$output{"fullpath_to_file$i"} = "$finalpath_real/$filename$file_ext"; # for attaching to notification emails.
	}

	if($num_files_really_sent == 0)
	{
		# In case they're allowing uploads without files.
		store_upload_info('', '', '', '', '', 0, $serial, \%textboxes) if info_system_is_enabled() || $PREF{enable_custom_sql_commands} =~ /yes/i;
	}

	do_automatic_resizing(\%upload_info);

	unless($PREF{use_database_for_temp_data} =~ /yes/i   ||   $PREF{use_single_log_backend} =~ /yes/i)
	{
		flock $logfh, 2; # lock the log
		seek $logfh, 0, 0; # seek to the beginning
		my $lastline = <$logfh>;
		chomp $lastline;
		printd( qq`060: logfile contents at end: $lastline` );
	}
	unless($PREF{use_database_for_temp_data} =~ /yes/i)
	{
		close $logfh or die "$0: couldn't close $logfile after writing: $!\n";
		chmod $PREF{writable_file_perms}, $logfile;
		#unlink $logfile if -e $logfile; # TODO: added 20100210; remove this if it causes client-side errors at the end of uploads (from progbar update requests that come in after the file's deleted)
		# Update 20110323: commenting-out this unlink() to see if it helps to work around sporadic Safari progbar issues.
		# Update again: re-enabling the unlink() to see if the new killkeepalive technique works.
		# 20111208: disabling this so our new upload monitor can view just-finished uploads;
		# instead we'll delete these as they age, via the delete-old-files mechanism:
	}

	if($rawpost)
	{
		close STDIN or enc_warn "$0: couldn't close STDIN (opened on file $rawpost): $!\n";
		unlink $rawpost or die "$0: couldn't unlink $rawpost: $!\n";
	}


	if($PREF{use_database_for_temp_data} =~ /yes/i   &&   $PREF{purge_temp_data_immediately} =~ /yes/i)
	{
		sql_untaint($PREF{serial});
		my $sth = $PREF{dbh}->prepare("DELETE FROM $PREF{table_name_for_temp_data} WHERE serial='$PREF{serial}';");
		$sth->execute or die "$0: $DBI::errstr\n";
	}

	unless($PREF{in_replace_mode})
	{
		$textbox_values_for_qs = get_textbox_values_for_qs(\%textboxes); # if info_system_is_enabled();
	}


	if(
		(		$PREF{email_notifications_to_webmaster} =~ /yes/i
			||	$PREF{email_notifications_to_userEntered_addresses} =~ /yes/i
			||	$PREF{email_notifications_to_userbase_loggedin_address} =~ /yes/i
			||	$PREF{email_notifications_to_userbase_folder_owner} =~ /yes/i
		)

		&&   !$PREF{in_replace_mode}   &&   !$PREF{in_addfile_mode}
	)
	{
		if($PREF{email_notifications_to_userbase_loggedin_address} =~ /yes/i)
		{
			if($PREF{admin_is_logged_in})
			{
				$PREF{email_notification_recipient__userbase_loggedin_address_admin} = $PREF{logged_in_email};
			}
			elsif($PREF{member_is_logged_in})
			{
				$PREF{email_notification_recipient__userbase_loggedin_address_member} = $PREF{logged_in_email};
			}
		}

		if($PREF{email_notifications_to_userbase_folder_owner} =~ /yes/i   &&   $PREF{userbase_folder_owner_email})
		{
			$PREF{email_notification_recipient__userbase_folder_owner} = $PREF{userbase_folder_owner_email};
		}

		my %addresses_already_notified = ();

		foreach my $recipient_key (sort keys %PREF)
		{
			if($recipient_key =~ /^(webmaster_)?email_notification_recipient_/)
			{
				my $recipient = $PREF{$recipient_key};
				next unless $recipient =~ /.+\@.+\..+/;
				next if $addresses_already_notified{$recipient};

				my $shortdatetime_end = strftime("%a%b%d,%Y,%I:%M%p", localtime($PREF{uploaddata}{$serial}{end_time})); # note: "%P" causes crashes/hangs on some Windows servers; use "%p" instead.
				my ($ip,$host) = ($PREF{ip},$PREF{host});
				my $uploadsize = format_filesize_nicely($ENV{CONTENT_LENGTH});
				my $userdir_for_email = $PREF{userdir} || '(none)';
				my $username_for_email = $PREF{logged_in_username} || '(none)';
				my %attachments = ();


				my $template = 'user';
				if($recipient_key =~ /^webmaster_email_notification_recipient_\d+$/)
				{
					$template = 'webmaster';
				}
				elsif($recipient_key =~ /^email_notification_recipient_fromtextbox_(\w+)template_/   ||   $recipient_key =~ /^email_notification_recipient_fromperfiletextbox_(\w+)template_/)
				{
					$template = $1;
				}
				elsif($recipient_key =~ /^email_notification_recipient_fromtextbox_/   ||   $recipient_key =~ /^email_notification_recipient_fromperfiletextbox_/)
				{
					$template = 'userEntered_addresses';
				}
				elsif($recipient_key =~ /^email_notification_recipient__userbase_loggedin_address_admin/)
				{
					$template = 'userbase_loggedin_address_admin';
				}
				elsif($recipient_key =~ /^email_notification_recipient__userbase_loggedin_address_member/)
				{
					$template = 'userbase_loggedin_address_member';
				}
				elsif($recipient_key =~ /^email_notification_recipient__userbase_folder_owner/)
				{
					$template = 'userbase_folder_owner';
				}
				elsif($recipient_key =~ /^email_notification_recipient_perfolder_/)
				{
					$template = 'per_folder_notifications';
				}

				my $attachfiles		= $PREF{"upload_email_template_for_${template}___attachfiles"};
				my $email_type		= $PREF{"upload_email_template_for_${template}___type"};
				my $from		= $PREF{"upload_email_template_for_${template}___sender"};
				my $email_subject	= $PREF{"upload_email_template_for_${template}___subject"};
				my $filelist_template	= $PREF{"upload_email_template_for_${template}___filelist"};
				my $formfields_template	= $PREF{"upload_email_template_for_${template}___formfields"};
				my $message		= $PREF{"upload_email_template_for_${template}___body"};


				if($from eq 'user_email_address')
				{
					$from = $PREF{first_user_entered_email_address};
					exit_with_error qq`Error: you've set \$PREF{upload_email_template_for_${template}___sender} to 'user_email_address', but no user address is available (got '$from'); make sure you've added a form field for the user to enter his email address (in PREFs Section 07).` unless is_valid_email_address($from);
				}
				elsif($from =~ /value_from_formfield_(.+)/)
				{
					my $shortname = $1; $shortname =~ s![<>]!!g; # in case they include the literal brackets from the documentation.
					$from = $textboxes{_by_shortname}{$shortname};
					exit_with_error qq`Error: you've set \$PREF{upload_email_template_for_${template}___sender} to 'value_from_formfield_$shortname', but no address from that formfield is available (got '$from'); make sure you've added a form field for the user to enter his email address (in PREFs Section 07).` unless is_valid_email_address($from);
				}
				next unless is_valid_email_address($from);


				# Get textbox values based on shortnames:
				my %textbox_values_for_email = ();
				foreach my $textbox (get_textbox_pref_keys('top', 'bottom'))
				{
					my $shortname = $PREF{"${textbox}_shortname"};
					if(my $group = $PREF{"${textbox}_group"})
					{
						$shortname = $PREF{"formfield_${group}_shortname"};
						$textbox = "formfield_$shortname";
					}
					$textbox_values_for_email{$shortname}{key} = $textbox; # for sorting.
					$textbox_values_for_email{$shortname}{value} = $textboxes{$textbox}{value};
					$textbox_values_for_email{$shortname}{value} =~ s!\n!<br />!g if $email_type =~ /html/i;
					$textbox_values_for_email{$shortname}{label} = $PREF{$textbox};
					$textbox_values_for_email{$shortname}{is_perfile} = 0;
				}

				foreach my $i (sort { $a <=> $b } keys %uploadedfiles)
				{
					foreach my $textbox (get_textbox_pref_keys('perfile'))
					{
						my $shortname = $PREF{"${textbox}_shortname"};
						$textbox_values_for_email{"${shortname}_$i"}{key} = "${textbox}_$i"; # for sorting.
						$textbox_values_for_email{"${shortname}_$i"}{value} = $textboxes{"${textbox}_$i"}{value};
						$textbox_values_for_email{"${shortname}_$i"}{value} =~ s!\n!<br />!g if $email_type =~ /html/i;
						$textbox_values_for_email{"${shortname}_$i"}{label} = $PREF{$textbox};
						$textbox_values_for_email{"${shortname}_$i"}{is_perfile} = 1;
					}

					if($attachfiles =~ /yes/i)
					{
						if(-f $output{"fullpath_to_file$i"})
						{
							$attachments{$i}{filename}		= $output{"fullpath_to_file$i"};
							$attachments{$i}{recommended_filename}	= $output{"fullpath_to_file$i"};
							$attachments{$i}{mimetype}		= "application/octet-stream";
							$attachments{$i}{'delete-after-sending'}= "no";
						}
						else
						{
							die qq`$0: process_upload(): could not prepare attachment(s) for notification email, because the file '$output{"fullpath_to_file$i"}' does not exist.\n` if $PREF{email_failure_action} eq 'die_on_email_error';
						}
					}
				}


				if($PREF{in_reprocessing_mode})
				{
					   if($PREF{upload_email_template_for_webmaster___subject__reprocessing} =~ /\S/	&&    $template eq 'webmaster')	{ $email_subject = $PREF{upload_email_template_for_webmaster___subject__reprocessing};	}
					elsif($PREF{upload_email_template_for_user___subject__reprocessing} =~ /\S/		&&    $template ne 'webmaster')	{ $email_subject = $PREF{upload_email_template_for_user___subject__reprocessing};	}
				}

				foreach my $templatable_item ($email_subject, $message)
				{
					interpolate_vars_from_URL_and_cookies('include_undefined', $templatable_item);

					my (@to_be_replaced, @replacement) = ();

					while($templatable_item =~ /(%{2,3}(.+?)%{2,3})/g)
					{
						my ($placeholder, $var_raw, $var) = ($1, $2, undef);
						next if $placeholder =~ /^%%%(.+)%%%$/; # skip any %%%if-foo%%%s, etc.

						if($var_raw =~ /^(.+?)--/)	{ $var = $1; }
						elsif($var_raw eq 'filelist')	{ next; }
						elsif($var_raw eq 'formfields')	{ next; }
						else				{ $var = $var_raw; }

						my $value = ();
						if($textbox_values_for_email{$var})		{ $value = $textbox_values_for_email{$var}{value};	}
						elsif($var eq 'uploader_ipaddress')		{ $value = $ip;						}
						elsif($var eq 'uploader_hostname')		{ $value = $host;					}
						elsif($var eq 'totalsize_bytes')		{ $value = $ENV{CONTENT_LENGTH};			}
						elsif($var eq 'totalsize_nice')			{ $value = $uploadsize;					}
						elsif($var eq 'userdir')			{ $value = $userdir_for_email;				}
						elsif($var eq 'username')			{ $value = $username_for_email;				}
						elsif($var eq 'startetime')			{ $value = $PREF{uploaddata}{$serial}{start_time}	}
						elsif($var eq 'starttime_nice')			{ $value = $shortdatetime;				} # $shortdatetime is an FC global.
						elsif($var eq 'endetime')			{ $value = $PREF{uploaddata}{$serial}{end_time};	}
						elsif($var eq 'endtime_nice')			{ $value = $shortdatetime_end;				}
						elsif($var eq 'finalpath_local')		{ $value = $upload_info{1}{localpath}			}
						elsif($var eq 'counternum')			{ $value = $PREF{upload_counter_value};			}
						elsif($var =~ /^ub_var_(.+)/)			{ $value = $PREF{$var};					}

						if($var_raw =~ /--date--(.+?)(--|$)/)
						{
							my $format = $1;
							$format =~ s/#/%/g;
							$value = strftime($format, localtime($value));
						}
						if($var_raw =~ /--urlencode(--|$)/)
						{
							enc_urlencode($value);
						}
						if($var_raw =~ /--winslashes(--|$)/)
						{
							$value =~ s!/!\\!g;
						}

						push @to_be_replaced, $placeholder;
						push @replacement, $value;
					}

					my $k = 0;
					foreach my $string (@to_be_replaced)
					{
						$templatable_item =~ s/$string/$replacement[$k]/;
						$k++;
					}
				}

				my @files = ();
				my $showing_perfile_fields_in_filelist = 0;
				foreach my $i (sort { $a <=> $b } keys %uploadedfiles)
				{
					my $file = $filelist_template;
					my $href = get_download_link('emails', $upload_info{$i}{localpath}, $upload_info{$i}{name});
					$href = $PREF{protoprefix} . $ENV{HTTP_HOST} . $href unless $href =~ m!^https?://!;
					my $nicesize = format_filesize_nicely($upload_info{$i}{size});

					$file =~ s!%%filename%%!$upload_info{$i}{name}!g;
					$file =~ s!%%rawname%%!$upload_info{$i}{rawname}!g;
					$file =~ s!%%extension%%!$upload_info{$i}{extension}!g;
					$file =~ s!%%realpath%%!$upload_info{$i}{realpath}!g;
					$file =~ s!%%urlpath%%!$upload_info{$i}{urlpath}!g;
					$file =~ s!%%localpath%%!$upload_info{$i}{localpath}!g;
					$file =~ s!%%filesize%%!$nicesize!g;
					$file =~ s!%%linktofile%%!$href!g;
					$file =~ s!%%filenum%%!$i!g;
					$file =~ s!%%filecount%%!$numitems!g;

					my ($width,$height,$xres,$yres,$width_inches,$height_inches) = is_image($upload_info{$i}{name}) ? get_image_dims($upload_info{$i}{realpath} . $upload_info{$i}{name}) : ();
					$file =~ s!%%imagedims%%!$width && $height ? qq`${width}x${height}` : $TEXT{unknown}!eg;
					$file =~ s!%%imageres%%!$xres && $yres ? qq`${xres}x${yres}` : $TEXT{unknown}!eg;
					$file =~ s!%%imagedims_inches%%!$width_inches && $height_inches ? qq`${width_inches}x${height_inches}` : $TEXT{unknown}!eg;
					$file =~ s!%%%if-isimage%%%(.+?)%%%end-isimage%%%!is_image($upload_info{$i}{name}) ? $1 : ''!egs;

					# If their filelist_template contains a %%%template:perfile_formfields%%%,
					# then automatically show the perfile formfields and values within the
					# filelist portion of the email, rather than with the other (non-perfile)
					# formfields.
					#
					if(my ($pfff_template_placeholder,$pfff_template) = ($file =~ m!(%%%template:perfile_formfields%%%(.*)%%%end-template:perfile_formfields%%%)!gs))
					{
						$showing_perfile_fields_in_filelist = 1;
						my $perfile_formfields = '';
						foreach my $textbox (get_textbox_pref_keys('perfile'))
						{
							my $shortname = $PREF{"${textbox}_shortname"};
							my $template_instance = $pfff_template;
							$template_instance =~ s!%%fieldname%%!$shortname!g;
							$template_instance =~ s!%%fieldvalue%%!$textbox_values_for_email{"${shortname}_$i"}{value}!g;
							$perfile_formfields .= $template_instance;
						}
						$file =~ s!$pfff_template_placeholder!$perfile_formfields!gs;
					}

					# Interpolate any individually-named perfile formfields.
					#
					$file =~ s!%%(\w+)%%!$textbox_values_for_email{"${1}_$i"}{value} if $textbox_values_for_email{"${1}_$i"}!eg;

					push @files, $file;
				}
				my $files = join '', @files;
				$message =~ s/%%filelist%%/$files/;

				my $formfields = '';
				foreach my $shortname (sort { $textbox_values_for_email{$a}{key} cmp $textbox_values_for_email{$b}{key} } keys %textbox_values_for_email)
				{
					next if $textbox_values_for_email{$shortname}{is_perfile} && $showing_perfile_fields_in_filelist && $PREF{show_perfile_fields_twice_in_notification_emails} !~ /yes/i;
					my $ff_template = $formfields_template;
					$ff_template =~ s!%%name%%!$shortname!g;
					$ff_template =~ s!%%label%%!$textbox_values_for_email{$shortname}{label}!g;
					$ff_template =~ s!%%value%%!$textbox_values_for_email{$shortname}{value}!g;
					$formfields .= $ff_template;
				}
				$message =~ s!%%%if-formfields%%%(.+?)%%%end-formfields%%%!$formfields ? $1 : ''!egs;
				$message =~ s!%%formfields%%!$formfields!g;

				my $serial_is_userdir_info = '';
				if($PREF{serial_is_userdir} =~ /yes/i   &&   !$PREF{admin_is_logged_in})
				{
					if($email_type =~ /html/i)
					{
						$serial_is_userdir_info .= qq`<p><br /></p><hr /><p>To access or reuse this uploads folder, go to:</p><p><a href="$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_filelist_qsready}action=listfiles&userdir=$PREF{userdir}">$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_filelist_qsready}action=listfiles&userdir=$PREF{userdir}</a></p>\n`;
						$serial_is_userdir_info .= qq`<p><br /></p><hr /><p>To make a completely new uploads folder, just use the front page:</p><p><a href="$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_uploader}">$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_uploader}</a></p>\n`;
					}
					else
					{
						$serial_is_userdir_info .= "\n\n" . '=' x 70 . qq`\nTo access or reuse this uploads folder, go to:\n\n$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_filelist_qsready}action=listfiles&userdir=$PREF{userdir}\n` . '=' x 70 . "\n";
						$serial_is_userdir_info .= "\n\n" . '=' x 70 . qq`\nTo make a completely new uploads folder, just use the front page:\n\n$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_uploader}\n` . '=' x 70 . "\n";
					}
				}
				$message =~ s/%%serial_is_userdir_info%%/$serial_is_userdir_info/;

				send_email($recipient, $from, $email_subject, $message, $email_type, $PREF{email_failure_action}, \%attachments);
				$addresses_already_notified{$recipient} = 1;
			}
		}
	}


	foreach my $cookie (keys %cookies_to_set)
	{
		set_cookie($cookie, $cookies_to_set{$cookie}, '+12M');
	}


	my @ftp_errors = ();
	if($PREF{ftp_files_to_another_server_after_upload} =~ /yes/i)
	{
		my @files = ();
		foreach my $i (sort { $a <=> $b } keys %upload_info)
		{
			push @files, $upload_info{$i}{localpath} . $upload_info{$i}{name};
		}
		@ftp_errors = ftp_files_to_another_server(@files);
		unshift(@ftp_errors, qq`<p style="font-weight: bold;">There were errors during the post-upload FTP process:</p>\n`) if @ftp_errors;
	}


	if($PREF{after_upload_redirect_to})
	{
		$PREF{user_supplied_afterupload_redirect} = $PREF{after_upload_redirect_to};
	}
	else
	{
		$PREF{after_upload_redirect_to} = "$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_uploadcomplete_qsready}action=uploadcomplete&serial=$serial";
	}

	interpolate_vars_from_URL_and_cookies('include_undefined', $PREF{after_upload_redirect_to});
	interpolate_vars_from_formfields(\%textboxes, $PREF{after_upload_redirect_to});
	$PREF{after_upload_redirect_to} =~ s!%%foldername%%!$upload_info{1}{localpath}!g;
	$PREF{after_upload_redirect_to} =~ s!%%counternum%%!$PREF{upload_counter_value}!g;
	$PREF{after_upload_redirect_to} =~ s/%PREF{(\w+)}/$PREF{$1}/g;

	if($PREF{pass_default_data_on_redirect} =~ /yes/i)
	{
		my $elapsed_secs = $PREF{uploaddata}{$serial}{end_time} - $PREF{uploaddata}{$serial}{start_time};

		my ($question_mark, $ampersand) = ();
		if($PREF{after_upload_redirect_to} =~ /\?/)
		{
			# if there's already a question-mark on the URL, we may need an ampersand.
			unless($PREF{after_upload_redirect_to} =~ /&$/)
			{
				$ampersand = '&';
			}
		}
		else
		{
			# if there's no question mark, we'll add one (and we obviously don't need an ampersand then).
			$question_mark = '?';
		}
		$PREF{after_upload_redirect_to} .= $question_mark . $ampersand . "numfiles=$numitems&elapsedsecs=$elapsed_secs&totalsize=$ENV{CONTENT_LENGTH}&somefileswereblocked=$some_files_were_blocked";
	}

	if($PREF{pass_original_querystring_through} =~ /yes/i)
	{
		my ($orig_qs) = ($ENV{HTTP_REFERER} =~ /.+?\?(.+)/);

		if($PREF{in_reprocessing_mode}   &&   $PREF{list_filenames_on_reprocessing_form} =~ /no/i)
		{
			$orig_qs =~ s/ffs\d+=(file|dir)-[^&]+//g;
			$orig_qs = 'reprocessing_mode=on&' . $orig_qs;
			$orig_qs =~ s/&{2,}/&/g;
		}

		my ($question_mark, $ampersand) = ();
		if($PREF{after_upload_redirect_to} =~ /\?/)
		{
			# if there's already a question-mark on the URL, we may need an ampersand.
			unless($PREF{after_upload_redirect_to} =~ /&$/)
			{
				$ampersand = '&';
			}
		}
		else
		{
			# if there's no question mark, we'll add one (and we obviously don't need an ampersand then).
			$question_mark = '?';
		}
		$PREF{after_upload_redirect_to} .= $question_mark . $ampersand . $orig_qs;
	}

	if($PREF{pass_filenames_on_redirect} =~ /yes/i)
	{
		unless($PREF{in_reprocessing_mode}   &&   $PREF{pass_filenames_when_reprocessing_is_done} =~ /no/i)
		{
			my ($numfiles, $fileinfo) = ();
			foreach my $i (sort { $a <=> $b } keys %upload_info)
			{
				$upload_info{$i}{urlpath} =~ s/^$PREF{uploaded_files_urlpath}//; # we don't need to display/pass this, especially if $PREF{hide_path_to_uploads_dir} is set.  after this s/// it'll just contain the upload subdir if any.

				enc_urlencode($upload_info{$i}{name}, $upload_info{$i}{urlpath}, $upload_info{$i}{localpath}, $upload_info{$i}{size});

				$fileinfo .= 'f' . $i . 'name='		. $upload_info{$i}{name}	. '&';
				$fileinfo .= 'f' . $i . 'urlpath='	. $upload_info{$i}{urlpath}	. '&';
				#$fileinfo .= 'f' . $i . 'localpath='	. $upload_info{$i}{localpath}	. '&';
				$fileinfo .= 'f' . $i . 'size='		. $upload_info{$i}{size}	. '&';
			}

			my ($question_mark, $ampersand) = ();
			if($PREF{after_upload_redirect_to} =~ /\?/)
			{
				# if there's already a question-mark on the URL, we may need an ampersand.
				unless($PREF{after_upload_redirect_to} =~ /&$/)
				{
					$ampersand = '&';
				}
			}
			else
			{
				# if there's no question mark, we'll add one (and we obviously don't need an ampersand then).
				$question_mark = '?';
			}
			$PREF{after_upload_redirect_to} .= $question_mark . $ampersand . $fileinfo;
		}
	}

	if($PREF{pass_formfield_values_on_redirect} =~ /yes/i)
	{
		my ($question_mark, $ampersand) = ();
		if($PREF{after_upload_redirect_to} =~ /\?/)
		{
			# if there's already a question-mark on the URL, we may need an ampersand.
			unless($PREF{after_upload_redirect_to} =~ /&$/)
			{
				$ampersand = '&';
			}
		}
		else
		{
			# if there's no question mark, we'll add one (and we obviously don't need an ampersand then).
			$question_mark = '?';
		}
		$PREF{after_upload_redirect_to} .= $question_mark . $ampersand . $textbox_values_for_qs;
	}

	if($PREF{output_started})
	{
		if($PREF{use_iframe_for_upload} =~ /yes/i)
		{
			$PREF{internal_qs_for_uploadcomplete_page} = ($PREF{after_upload_redirect_to} =~ /\?(.+)/)[0];
			show_uploadcomplete_page(@ftp_errors);
		}
		else
		{
			print qq`\n<div>`;
			print qq`\n<p>Output has already started, so we can't redirect (perhaps debug is enabled; you can disable it in PREFs Section 01).</p>\n\n`;
			print qq`\n<p>Here's where we would have gone:</p>\n\n`;
			print qq`\n<p><a href="$PREF{after_upload_redirect_to}">$PREF{after_upload_redirect_to}</a></p>\n\n`;
			print @ftp_errors if @ftp_errors;
			print qq`\n</div>\n`;
		}
	}
	else
	{
		if(@ftp_errors)
		{
			$PREF{internal_qs_for_uploadcomplete_page} = ($PREF{after_upload_redirect_to} =~ /\?(.+)/)[0];
			show_uploadcomplete_page(@ftp_errors);
		}
		else
		{
			if($PREF{user_supplied_afterupload_redirect}   &&   $PREF{use_iframe_for_upload} =~ /yes/i)
			{
				print_http_headers();
				print qq`<html><head></head><body><input type="hidden" name="fc_afterupload_redirect" id="fc_afterupload_redirect" value="$PREF{after_upload_redirect_to}" /></body></html>\n`;
			}
			else
			{
				enc_redirect($PREF{after_upload_redirect_to});
			}
		}
	}
}


sub show_uploadcomplete_page
{
	my @extra_messages = @_;

	$PREF{on_page} = 'uploadcomplete';
	$PREF{userdir} = $PREF{enable_userdirs} = '' if $PREF{enforce_userdir_restrictions_on_upload_page} =~ /no/i;

	$qs = $PREF{internal_qs_for_uploadcomplete_page} || $qs;

	my $template = $PREF{in_reprocessing_mode} ? $PREF{upload_complete_page_template___reprocessing} : $PREF{upload_complete_page_template};
	my $filelist_template = '';

	my ($numitems) = ($qs =~ /(?:^|&)numfiles=(\d+)(?:&|$)/);
	my ($contentlength) = ($qs =~ /(?:^|&)totalsize=(\d+)(?:&|$)/);
	my $total_upload_size = format_filesize_nicely($contentlength);

	$template =~ s!%%total_file_count%%!$numitems!g;
	$template =~ s!%%total_upload_size%%!$total_upload_size!g;



	my ($elapsed_secs) = ($qs =~ /(?:^|&)elapsedsecs=(\d+)(?:&|$)/);
	my $leftover_secs = $elapsed_secs % 60;
	my $elapsed_mins = int(($elapsed_secs % 3600) / 60);
	my $elapsed_hours = int($elapsed_secs / 3600);

	my $sec_label  = $leftover_secs == 1 ? $TEXT{second} : $TEXT{seconds};
	my $min_label  = $elapsed_mins == 1 ? $TEXT{minute} : $TEXT{minutes};
	my $hour_label = $elapsed_hours == 1 ? $TEXT{hour} : $TEXT{hours};

	$elapsed_secs = 1 if $elapsed_secs < 1; # make sure we're not dividing by zero or using a negative time.
	my $average_speed = format_filesize_nicely($contentlength / $elapsed_secs) . '/s';

	my $elapsed_time =
		  ($elapsed_hours ? "${elapsed_hours} $hour_label " : '')
		. ($elapsed_mins ? "${elapsed_mins} $min_label " : '')
		. qq`${leftover_secs} $sec_label `;

	$template =~ s!%%elapsed_time%%!$elapsed_time!g;
	$template =~ s!%%average_speed%%!$average_speed!g;



	my $formfields = '';
	while($qs =~ /(?:^|&)ff(\d+)v=([^&]+)/g)
	{
		my ($fieldnum, $fieldvalue) = ($1,$2,$3);
		enc_urldecode($fieldvalue);
		$fieldvalue =~ s!\n!<br />!g;
		my $fieldname = $PREF{"formfield_${fieldnum}"} ? $PREF{"formfield_${fieldnum}"} : $PREF{"formfield_${fieldnum}_shortname"};
		my $colon = $fieldname =~ /:\s*$/ ? '' : ':';
		$formfields .= qq`<dd>$fieldname$colon $fieldvalue</dd>\n` if $fieldname;
	}
	$template =~ s!%%%if-formfields%%%(.+?)%%%end-formfields%%%!$formfields ? $1 : ''!egs;
	$template =~ s!%%formfields%%!$formfields!g;



	# This is mainly for $PREF{in_reprocessing_mode}:
	#
	my $subdir_from_url = ();
	if($qs =~ /(?:^|&)path=(.+?)(?:&|$)/)
	{
		$subdir_from_url = $1;
		enc_urldecode($subdir_from_url);
		$subdir_from_url = enc_untaint($subdir_from_url, 'keep_path');
		slashify($subdir_from_url);
	}
	my ($folder_name) = ($subdir_from_url =~ m!([^/]+)/*$!);
	$folder_name = '/' unless $folder_name;
	$template =~ s!%%folder_name%%!$folder_name!g;



	for(my $i=1; $i<=$numitems; $i++)
	{
		my $filelist_template_i = $PREF{in_reprocessing_mode} ? $PREF{upload_complete_filelist_template___reprocessing} : $PREF{upload_complete_filelist_template};

		my ($name)	= ($qs =~ /(?:^|&)f${i}name=(.*?)(?:&|$)/);
		#my ($realpath)	= ($qs =~ /(?:^|&)f${i}realpath=(.*?)(?:&|$)/);
		#my ($localpath)= ($qs =~ /(?:^|&)f${i}localpath=(.*?)(?:&|$)/);
		my ($localpath)	= ($qs =~ /(?:^|&)f${i}urlpath=(.*?)(?:&|$)/);
		my ($size)	= ($qs =~ /(?:^|&)f${i}size=(.*?)(?:&|$)/);

		enc_urldecode($name,$localpath,$size);

		my $urlpath = $PREF{uploaded_files_urlpath} . $localpath;
		my $link = get_download_link('uploadcomplete_page', $localpath, $name);
		my $link_with_fqdn = "$PREF{protoprefix}$ENV{HTTP_HOST}$link";

		my $perfile_formfields = '';
		while($qs =~ /(?:^|&)ff(\d+)_(\d+)v=([^&]+)/g)
		{
			my ($fieldnum, $filenum, $fieldvalue) = ($1,$2,$3);
			enc_urldecode($fieldvalue);
			if($filenum == $i)
			{
				my $fieldname = $PREF{"formfield_${fieldnum}"} ? $PREF{"formfield_${fieldnum}"} : $PREF{"formfield_${fieldnum}_shortname"};
				my $colon = $fieldname =~ /:\s*$/ ? '' : ':';
				$perfile_formfields .= qq`<dd>$fieldname$colon $fieldvalue</dd>\n` if $fieldname;
			}
		}
		$filelist_template_i =~ s!%%%if-perfile_formfields%%%(.+?)%%%end-perfile_formfields%%%!$perfile_formfields ? $1 : ''!egs;
		$filelist_template_i =~ s!%%perfile_formfields%%!$perfile_formfields!g;

		my ($illegal, $replaceerror, $viruserror, $success) = (0,0,0,0);
		if($size eq 'EILLEGALEXT')	{ ($illegal, $replaceerror, $viruserror, $success) = (1,0,0,0); }
		elsif($size eq 'ENOREPLACE')	{ ($illegal, $replaceerror, $viruserror, $success) = (0,1,0,0); }
		elsif($size eq 'EVIRUSSCAN')	{ ($illegal, $replaceerror, $viruserror, $success) = (0,0,1,0); }
		else				{ ($illegal, $replaceerror, $viruserror, $success) = (0,0,0,1); }

		$filelist_template_i =~ s!%%filenum%%!$i!g;
		$filelist_template_i =~ s!%%total_file_count%%!$numitems!g;
		$filelist_template_i =~ s!%%filename%%!$name!g;
		$filelist_template_i =~ s!%%filesize%%!format_filesize_nicely($size)!eg;
		$filelist_template_i =~ s!%%link%%!$link!g;
		$filelist_template_i =~ s!%%link_with_fqdn%%!$link_with_fqdn!g;
		$filelist_template_i =~ s!%%%if-isimage%%%(.+?)%%%end-isimage%%%!is_image($name) ? $1 : ''!egs;

		$filelist_template_i =~ s!%%%if-illegal%%%(.+?)%%%end-illegal%%%!$illegal ? $1 : ''!egs;
		$filelist_template_i =~ s!%%%if-replaceerror%%%(.+?)%%%end-replaceerror%%%!$replaceerror ? $1 : ''!egs;
		$filelist_template_i =~ s!%%%if-viruserror%%%(.+?)%%%end-viruserror%%%!$viruserror ? $1 : ''!egs;
		$filelist_template_i =~ s!%%%if-success%%%(.+?)%%%end-success%%%!$success ? $1 : ''!egs;
		$filelist_template_i =~ s!%%%if-showlinks%%%(.+?)%%%end-showlinks%%%!show_files_as_links_on_upload_complete_page() ? $1 : ''!egs;
		$filelist_template_i =~ s!%%%if-showbbcodeetc%%%(.+?)%%%end-showbbcodeetc%%%!lc($PREF{show_bbcode_html_etc_on_uploadcomplete_page}) eq 'yes' ? $1 : ''!egs;
		$filelist_template_i =~ s!%%%ifelse-showlinks%%%(.*?)%%%else%%%(.*?)%%%endelse-showlinks%%%!show_files_as_links_on_upload_complete_page() ? $1 : $2!egs;

		$filelist_template .= $filelist_template_i;
	}



	$template =~ s!%%filelist%%!$filelist_template!g;



	if(@extra_messages)
	{
		$template .= qq`<div id="extra-messages">\n`;
		$template .= join "\n<br /><br />", @extra_messages;
		$template .= qq`</div>\n`;
	}

	if($PREF{serial_is_userdir} =~ /yes/i   &&   !$PREF{admin_is_logged_in})
	{
		$template .= qq`<p><b>Note:</b> if you want to reuse this uploads folder, please bookmark &amp; use <a href="$PREF{here_filelist_qsready}action=listfiles&userdir=$PREF{userdir}">this link</a>.</p>\n`;
		$template .= qq`<p><b>Or,</b> to make a completely new uploads folder, just use <a href="$PREF{here_uploader}">the front page</a>.</p>\n`;
	}

	if(my ($oldserial) = ($qs =~ /(?:^|&)serial=(\w+)(?:&|$)/))
	{
		my $tempfile = "$PREF{datadir}/${oldserial}.fctemp.log";
		# 20111208: disabling this so our new upload monitor can view just-finished uploads;
		# instead we'll delete these as they age, via the delete-old-files mechanism:
		#unlink($tempfile) if -e $tempfile;
	}


	start_html_output($PREF{subtitle___uploadcomplete});
	print $template;
	finish_html_output('home', 'uploader', 'list', 'getscript');
}


#sub user_has_write_access_to_path($)
#{
#	my $path_local = shift;
#	slashify($path_local);
#
#	my @writable_dirs = get_all_writable_directories();
#	foreach my $dir (@writable_dirs)
#	{
#		slashify($dir);
#		return 1 if $path_local eq $dir;
#	}
#
#	return 0;
#}


sub filename_is_illegal($)
{
	my $filename = shift;
	my ($this_files_extension) = ($filename =~ /.*(\..+)$/);
	my $illegal = 0;
	if($PREF{only_allow_these_file_extensions} =~ /(.+)/)
	{
		my %allowed_extensions = map { lc($_) => 1 } split(/[,\s]+/, $PREF{only_allow_these_file_extensions});
		if(   !$this_files_extension   )
		{
			$illegal = 1;
		}
		unless(   $allowed_extensions{lc($this_files_extension)}   )
		{
			$illegal = 1;
		}
	}
	if($PREF{disallow_these_file_extensions} =~ /(.+)/)
	{
		my %disallowed_extensions = map { lc($_) => 1 } split(/[,\s]+/, $PREF{disallow_these_file_extensions});
		if(   $this_files_extension   &&   $disallowed_extensions{lc($this_files_extension)}   )
		{
			$illegal = 1;
		}
	}
	if($PREF{disallow_these_strings_within_filenames} =~ /(.+)/)
	{
		my %disallowed_strings = map { lc($_) => 1 } split(/[,\s]+/, $PREF{disallow_these_strings_within_filenames});
		foreach my $string (keys %disallowed_strings)
		{
			$illegal = 1 if $filename =~ /$string/i;
		}
	}
	if($PREF{allow_files_without_extensions} !~ /yes/i)
	{
		$illegal = 1 unless $this_files_extension;
	}
	$illegal = 1 unless $filename =~ /[0-9a-zA-Z]/;
	return $illegal;
}


sub generate_serial_number
{
	$PREF{serial} = $$;
	$PREF{serial} .= $ENV{REMOTE_PORT};

	my $offsettime = offsettime();
	$offsettime =~ s/.*(\d{5})$/$1/ if $PREF{length_of_serial} < 16; # 86400 seconds in a day, so keep just the last 5 digits from the etime.
	$PREF{serial} .= $offsettime;

	my ($first_octet, $second_octet, $third_octet, $fourth_octet) = ($PREF{ip} =~ /(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
	$PREF{serial} .= $fourth_octet . $third_octet . $second_octet . $first_octet;

	my $digits_from_UA = $ENV{HTTP_USER_AGENT};
	$digits_from_UA =~ s/[^\d]//g;
	$PREF{serial} .= $digits_from_UA;

	if($PREF{use_letters_in_serial} =~ /yes/i)
	{
		my @digits = split(//, $PREF{serial});
		my $i = 1;
		my $j = 1;
		foreach my $digit (@digits)
		{
			if($i % 2 == 0)
			{
				$digit = chr($digit + ($j % 2 == 0 ? 65 : 97));
				$j++;
			}
			$i++;
		}
		$PREF{serial} = join '', @digits;
	}

	$PREF{serial} =~ s/^(.{$PREF{length_of_serial}}).*/lc($1)/e;
	if($PREF{use_hash_for_serial} =~ /yes/i)
	{
		$PREF{serial} = md5_hex($PREF{serial});
		my $cutlength = $PREF{cut_serial_to_this_length_even_after_hashing};
		if($cutlength =~ /^\d+$/ && $cutlength > 0)
		{
			$PREF{serial} =~ s/^(.{$cutlength}).*/lc($1)/e;
		}
	}

	return $PREF{serial};
}


sub load_prefs()
{
	$PREF{internal_appname_nice}	= 'FileChucker';
	$PREF{internal_appname}		= 'filechucker';
	$PREF{internal_filename}	= 'filechucker';
	$PREF{twochar_app_id}		= 'fc';


	do_preinit();


	# Note: some things won't work while the debuglog is enabled (the progress bar being one).
	#
	#open($debuglog, ">>fcdebug.txt") or die_nice("couldn't open debuglog: $!\n"); flock $debuglog, 2; print $debuglog "\n\n==========\n$$ starting:"; $PREF{force_debug} = 'yes';


	verify_server_environment();
	fix_server_environment();


	# Pre-PREF init stuff: default PREF values, etc.
	#
	populate_month_conversion_hashes();
	$PREF{num_hook_calls} = 0;
	$PREF{extra_footer_links} = [];
	$PREF{extra_administration_links} = [];
	$PREF{try_to_use_imagemagick_for_dimensions}			= 'yes';
	$PREF{try_to_use_gd_for_dimensions}				= 'yes';
	$PREF{folder_name_for_working_with_zip_files}			= 'fcziptmp';
	$PREF{app_output_template___skip_init_var_expansion}		= 'yes'; # so we can use %PREF{title} in the template and replace it with $PREF{"title_$PREF{on_page}"}, doing the %PREF{title} interpolation within the output sub rather than within load_prefs().


	set_default_prefs_for_all_apps();
	check_for_enc_visitor_id();
	load_external_prefs();
	load_other_prefs_files();


	settle_docroot_datadir_cgimodule_etc();
	cache_and_read_any_nonpost_env_vars();


	# Webconfig must happen after datadir is settled, since it needs to read/write there:
	#
	load_webconfig_prefs();


	figure_out_where_here_is();
	determine_cookie_domain();


	# Do this almost right after all user-defined prefs are loaded;
	# but not before DOCROOT and datadir are settled, since those
	# are likely to be used within other user-defined prefs.
	#
	expand_custom_vars_in_prefs();


	# Load UserBase prefs after settling DOCROOT in case we used
	# %PREF{DOCROOT} in the path to the UserBase prefs file.
	#
	load_userbase_prefs();


	# Now all prefs are loaded.
	#
	do_postpref_processing();
	($PREF{ip}, $PREF{host}) = get_ip_and_host();
	do_blacklisting_and_whitelisting();


	# Verify servable datadirs and similar directories here.
	#
	$PREF{name_of_subfolder_for_thumbnails_etc} = 'encmisc' unless $PREF{name_of_subfolder_for_thumbnails_etc};
	die_nice("Error: invalid setting for \$PREF{name_of_subfolder_for_thumbnails_etc} ('$PREF{name_of_subfolder_for_thumbnails_etc}').  It's recommended to leave this set to its default value.") unless $PREF{name_of_subfolder_for_thumbnails_etc} =~ m!\w! && $PREF{name_of_subfolder_for_thumbnails_etc} =~ m!^[\w\.]+$!;


	if(database_required())
	{
		get_db_connection();
		create_db_tables_if_DNE();
		$PREF{database_is_in_use} = 1;
	}




	$PREF{REQ_URI_SANS_QS} = ($ENV{REQUEST_URI} =~ /^([^\?]+)/)[0];
	$PREF{we_are_virtual} = $PREF{REQ_URI_SANS_QS} ne $ENV{SCRIPT_NAME};

	$PREF{protoprefix} = $PREF{protoprefix} ? $PREF{protoprefix} : ($ENV{SERVER_PORT} =~ /443/ || $ENV{HTTPS} =~ /on/i) ? 'https://' : 'http://';

	if($PREF{add_www_to_hostname} =~ /yes/i && $ENV{HTTP_HOST} !~ /^www\./i)
	{
		my $go = "$PREF{protoprefix}www.$ENV{HTTP_HOST}$PREF{REQ_URI_SANS_QS}" . ($qs ? "?$qs" : '');
		enc_redirect($go);
	}
	elsif($PREF{add_www_to_hostname} !~ /yes/i && $PREF{remove_www_from_hostname} =~ /yes/i && $ENV{HTTP_HOST} =~ /^www\.(.+)/i)
	{
		my $host = $1;
		my $go = "$PREF{protoprefix}$host$PREF{REQ_URI_SANS_QS}" . ($qs ? "?$qs" : '');
		enc_redirect($go);
	}

	if($PREF{force_https} =~ /yes/i && $ENV{HTTPS} !~ /^(on|yes|enabled|true|1)$/i)
	{
		my $go = "https://$ENV{HTTP_HOST}$PREF{REQ_URI_SANS_QS}" . ($qs ? "?$qs" : '');
		enc_redirect($go);
	}

	if($PREF{prevent_direct_cgi_access} =~ /yes/i   &&   !$PREF{we_are_virtual}   &&   $ENV{REQUEST_METHOD} !~ /post/i   &&   !$qs)
	{
		print_http_headers();
		print $PREF{direct_cgi_access_error};
		exit;
	}

	$PREF{time_offset}			= $PREF{time_offset} * 3600			if $PREF{time_offset} =~ /^-?\d+$/;



	# Set globals. TODO: some of these need to be re-scoped.
	#
	$starttime				= offsettime();
	$total_upload_size			= ();
	%temp					= ();
	$num_files_in_progress_or_done		= 0;
	$total_file_count			= $qs =~ /(?:^|&)items=(\d+)(?:&|$)/ ? $1 : $PREF{using_custom_file_elements} =~ /yes/i ? $PREF{num_custom_file_elements} : $PREF{num_default_file_elements} =~ /^\d+$/ ? $PREF{num_default_file_elements} : 1;
	$shortdatetime				= strftime("%a%b%d,%Y,%I:%M%p",		localtime(offsettime())); # note: "%P" causes crashes/hangs on some Windows servers; use "%p" instead.
	$shortdatetime_forfilename		= strftime("%a%b%d,%Y,%Hh%Mm%Ss%p",	localtime(offsettime())); # note: "%P" causes crashes/hangs on some Windows servers; use "%p" instead.
	$datestring8				= strftime("%Y%m%d",			localtime(offsettime()));

	$PREF{mkdir_action_name}		= 'makefolder'		unless exists $PREF{mkdir_action_name}; # necessary because some servers are configured to throw a 403 Forbidden error for any URL containing the string "mkdir".
	$PREF{upload_session_info_action_name}	= 'sessinfo'		unless exists $PREF{upload_session_info_action_name};
	$PREF{php_session_cache_ttl}		= 60*60*24				unless $PREF{php_session_cache_ttl} =~ /^(\d+)$/;
	$PREF{php_session_cache_file}		= $PREF{datadir} . '/phpcache.txt'	unless exists $PREF{php_session_cache_file};
	$PREF{php_session_cookie_name}		= 'PHPSESSID'				unless exists $PREF{php_session_cookie_name};
	$PREF{currency_symbol}			= '$'			unless exists $PREF{currency_symbol};

	$PREF{in_reprocessing_mode}		= 1 if ($PREF{enable_reprocessing_mode} =~ /yes/i	&&   ($qs =~ /(?:^|&)ffs\d+=file-(.+?)(?:&|$)/ || $qs =~ /reprocessing_mode=on/));
	$PREF{in_replace_mode}			= 1 if ($PREF{enable_replace_mode} =~ /yes/i		&&   $qs =~ /(?:^|&)rfn\d+=file-(.+?)(?:&|$)/);
	$PREF{in_addfile_mode}			= 1 if ($PREF{enable_addfile_mode} =~ /yes/i		&&   $qs =~ /(?:^|&)addfilemode=on(?:&|$)/);

	$PREF{enable_subdirs}			= 'yes' if $PREF{enable_userdirs} =~ /yes/i;

	$PREF{multiple_files_in_one_element}	= qq`multiple="multiple"` unless $ENV{HTTP_USER_AGENT} =~ /opera/i && $PREF{disable_multiple_files_in_one_element_for_opera} =~ /yes/i;



	# Do any PREFs initialization that doesn't depend on things like userdir, database connection, etc.
	#
	if(   ($PREF{upload_email_template_for_webmaster___subject} || $PREF{upload_email_template_for_webmaster___filelist})   && !$PREF{upload_email_template_for_webmaster___body})
	{
		exit_with_error(qq`Error: you must set \$PREF{upload_email_template_for_webmaster___body} before you can use \$PREF{upload_email_template_for_webmaster___subject} or \$PREF{upload_email_template_for_webmaster___filelist}.`);
	}
	if(   ($PREF{upload_email_template_for_user___subject} || $PREF{upload_email_template_for_user___filelist})   && !$PREF{upload_email_template_for_user___body})
	{
		exit_with_error(qq`Error: you must set \$PREF{upload_email_template_for_user___body} before you can use \$PREF{upload_email_template_for_user___subject} or \$PREF{upload_email_template_for_user___filelist}.`);
	}


	if($PREF{serial_is_userdir} =~ /yes/i)
	{
		$PREF{enable_userdirs}			= 'yes';
		$PREF{enable_userdir_from_login_system}	= 'no';
		$PREF{keep_userdir_on_url}		= 'yes';
		$PREF{enable_userdir_on_url}		= 'yes';
		$PREF{auto_create_userdirs}		= 'yes';
		$PREF{enable_subdirs}			= 'yes';

		unless($PREF{override_default_serial_is_userdir_settings} =~ /yes/i)
		{
			$PREF{error_if_userdir_not_supplied}				= 'yes';
			$PREF{groups_allowed_to_upload}					= 'public';
			$PREF{groups_allowed_to_view_download_page}			= 'public';
			$PREF{groups_allowed_to_download}				= 'public';
			$PREF{groups_allowed_to_delete_items}				= 'public';
			$PREF{hide_path_to_uploads_dir}					= 'yes';
			$PREF{display_dropdown_box_for_subdir_selection}		= 'no';
			$PREF{navigate_users_into_userdirs_automatically}		= 'yes';
			$PREF{hide_links_to_topmost_level_from_userdir_users}		= 'yes';
			$PREF{show_the_create_new_subdir_field_on_upload_form}		= 'no';
		}
	}


	#if($PREF{after_upload_redirect_to})
	#{
	#	$PREF{use_iframe_for_upload} = 'no';
	#}
	$PREF{use_iframe_for_upload} = 'no' if get_qs_var('iframe') eq 'no';
	if($PREF{use_iframe_for_upload} !~ /yes/i)
	{
		$PREF{show_upload_status_in_popup_window} = 'yes' if $ENV{HTTP_USER_AGENT} =~ /safari/i;
	}


	create_formfield_prefs_for_custom_form_fields();

	foreach my $prefname (sort keys %PREF)
	{
		if($prefname =~ /^formfield_(\d+)$/)
		{
			#
			# Perform various init-type stuff for the formfields.
			#

			my $num = $1;
			my $prefshortname = "formfield_${num}_shortname";
			if(!$PREF{$prefshortname})
			{
				# Create _shortnames for any formfields that don't have them.
				#
				my $shortname = $PREF{$prefname};
				$shortname =~ s/[^\w]/_/g;
				defooify('_',$shortname);
				$PREF{$prefshortname} = $shortname;
			}
			die_nice qq`Error: invalid shortname '$PREF{$prefshortname}' for your '$prefshortname' setting.&nbsp; The shortname must contain only letters, numbers, and underscores.` unless $PREF{$prefshortname} =~ /^\w+$/;

			$PREF{"formfield_${num}_position"} = 'top' if !$PREF{"formfield_${num}_position"};

			if($PREF{store_upload_info_in_database} =~ /yes/i   &&   $PREF{automatically_store_my_formfields_in_db} =~ /yes/i)
			{
				add_formfield_column_to_upload_log_table($prefshortname);
			}
		}

		elsif($prefname =~ /^formfield_(.+)_is_group_master$/)
		{
			my $group_identifier = $1;
			my $prefshortname = "formfield_${group_identifier}_shortname";
			if($PREF{store_upload_info_in_database} =~ /yes/i   &&   $PREF{automatically_store_my_formfields_in_db} =~ /yes/i)
			{
				add_formfield_column_to_upload_log_table($prefshortname);
			}
		}

		elsif($PREF{enable_perfile_passwords} =~ /yes/i   &&   $prefname =~ /^formfield_(\d+)_password$/)
		{
			# Automatically enable $PREF{download_links_go_through_FileChucker} if perfile passwords are enabled:
			my $num = $1;
			if($PREF{$prefname} =~ /yes/i)
			{
				$PREF{perfile_pw_firsthalf_enabled} = 1 if $PREF{"formfield_${num}_shortname"} eq 'filepw';
				$PREF{perfile_pw_secondhalf_enabled} = 1 if $PREF{"formfield_${num}_shortname"} eq 'filepwverify';
				if($PREF{perfile_pw_firsthalf_enabled} && $PREF{perfile_pw_secondhalf_enabled})
				{
					$PREF{download_links_go_through_FileChucker} = 'yes';
					$PREF{store_upload_info_in_database} = 'yes';
				}
			}
		}

		elsif($prefname =~ /^admin_password_hash(_\d\d)?$/  && $PREF{$prefname})	{ $PREF{all_admin_password_hashes}{$PREF{$prefname}} = 1; }
		elsif($prefname =~ /^member_password_hash(_\d\d)?$/ && $PREF{$prefname})	{ $PREF{all_member_password_hashes}{$PREF{$prefname}} = 1; }

		elsif($PREF{$prefname} eq 'filechucker@example.com') { $PREF{$prefname} = 'filechucker@'.($ENV{HTTP_HOST} =~ /^(www\.)?([^:]+)/)[1]; }
	}




	# Init stuff.
	#
	load_styles();
	my $listmode = get_cookie("fclistmode");
	$PREF{current_filelist_mode} = $listmode ? $listmode : $PREF{default_filelist_mode};
	determine_current_style();


	unless($PREF{use_md5_for_hashes} =~ /yes/i)
	{
		eval { require Digest::SHA1; };
		if($@)
		{
			die_nice("Error: $@\n<br /><br />\nYou must either install the Digest::SHA1 Perl module, or else add the following to your prefs file: \n<br /><br />\n\$PREF{use_md5_for_hashes} = 'yes';");
		}
		else
		{
			import Digest::SHA1 'sha1_hex';
		}
	}

	$PREF{download_links_go_through_FileChucker} = 'yes' if (
		$PREF{groups_allowed_to_download} ne $PREF{public_group_name}
		||   exists $PREF{hotlink_whitelist}
		||   $PREF{send_download_notification_emails} =~ /yes/i
		||   $PREF{update_timestamp_on_download} =~ /yes/i
		||   $PREF{log_all_downloads} =~ /yes/i
	);


	try_to_load_image_modules();


	# Stuff that must happen before we process the ?js command:
	#
	if($PREF{enable_human_test} =~ /yes/i)
	{
		if(image_humantest_possible())
		{
			condense_slashes('leave_leading_UNC', $PREF{human_test_image_directory___real});
			$PREF{human_test_image_directory___real} = enc_untaint($PREF{human_test_image_directory___real}, 'keep_path');

			create_dir_if_DNE($PREF{human_test_image_directory___real}, $PREF{writable_dir_perms}, 'make_parents');
			die_nice("\$PREF{human_test_image_directory___real} ('$PREF{human_test_image_directory___real}') does not exist; you must create it.") unless -d "$PREF{human_test_image_directory___real}";
			die_nice("\$PREF{human_test_image_directory___real} ('$PREF{human_test_image_directory___real}') is not writable; you must chmod it to world-writable or 0777.") unless -w "$PREF{human_test_image_directory___real}";

			$PREF{human_test_salt_value} = enc_untaint($PREF{human_test_salt_value});
			($PREF{humantest_code}) = (rand() =~ /(\d{$PREF{human_test_num_digits}})/);
			$PREF{humantest_hash} = md5_hex($PREF{humantest_code} . $PREF{human_test_salt_value});
			printd "humantest_code=$PREF{humantest_code}, humantest_hash=$PREF{humantest_hash}, human_test_salt_value=$PREF{human_test_salt_value}";
		}
		else
		{
			die_nice qq`
			In order to use the human-test feature, you must enable one of the following settings:
			<br /><br />\n\$PREF{try_to_use_imagemagick_for_humantest} 
			<br /><br />\n\$PREF{try_to_use_gd_for_humantest}
			<br /><br />\n\$PREF{try_to_use_convert_for_humantest} 
			<br /><br />\nYou must also have either the ImageMagick Perl module installed 
			(it is ` . (imagemagick_is_available() ? '' : 'not ') . qq`currently installed), 
			<br /><br />\nor the GD and GD::Simple Perl modules installed 
			(they are ` . (gd_is_available() ? '' : 'not ') . qq`currently installed),
			<br /><br />\nor you must have ImageMagick's "convert" program available and set \$PREF{convert_command} to its path.
			`;
		}
	}
	$PREF{disallow_these_strings_within_filenames___for_js} = $PREF{disallow_these_strings_within_filenames};
	$PREF{disallow_these_strings_within_filenames___for_js} =~ s!\\!\\\\!g; # backslashes need to be doubled in JS regexes.



	$PREF{length_of_serial} = 30 unless $PREF{length_of_serial} =~ /^\d+$/;
	if($qs =~ /(?:^|&)serial=([0-9a-zA-Z]+)(?:&|$)/)
	{
		$PREF{serial} = $1;
	}
	else
	{
		$PREF{serial} = generate_serial_number();
	}



	# FC-specific here_ values:
	#
	for('here_error', 'here_uploader', 'here_popupstatus', 'here_filelist', 'here_viewer')
	{
		$PREF{$_} = $PREF{here} unless $PREF{$_}; # ($PREF{$_} && $PREF{$_} ne $ENV{SCRIPT_NAME}); # can't require ne SCRIPT_NAME, or else we can never set any of these to SCRIPT_NAME manually, which we do want to do sometimes, for example for here_popupstatus and sometimes here_uploadcomplete.
		$PREF{$_} = $ENV{SCRIPT_NAME} unless $PREF{$_} =~ /./;

		$PREF{$_ . '_qsready'} = $PREF{$_} =~ /\?/ ? "$PREF{$_}&amp;" : "$PREF{$_}?";
	}

	$PREF{here_uploadcomplete} ||= $PREF{use_iframe_for_upload} =~ /yes/i ? $ENV{SCRIPT_NAME} : $PREF{here};
	$PREF{here_uploadcomplete_qsready} = $PREF{here_uploadcomplete} =~ /\?/ ? "$PREF{here_uploadcomplete}&amp;" : "$PREF{here_uploadcomplete}?";


	if(exists $PREF{custom_footer})
	{
		for($PREF{custom_footer_for_uploader}, $PREF{custom_footer_for_popupstatus}, $PREF{custom_footer_for_uploadcomplete}, $PREF{custom_footer_for_default}, $PREF{custom_footer_for_filelist})
		{
			$_ = $PREF{custom_footer} unless $_;
		}
	}

	$PREF{uploaded_files_dir}	= '/upload/files'					unless exists $PREF{uploaded_files_dir};


	$PREF{default_url_vars} = "&forcefullhtml=yes" if $qs =~ /forcefullhtml=yes/i;
	$PREF{default_url_vars} .= "&$1" if $qs =~ /(?:^|&)(prefs=[^&]+)/;
	$PREF{default_url_vars} .= "&$1" if $qs =~ /(?:^|&)(prefsfile=[^&]+)/;


	for($PREF{sizelimit_for_public}, $PREF{sizelimit_for_members}, $PREF{sizelimit_for_admins})
	{
		if(/\d+\s*\*/)
		{
			my @values = split /[\s\*]+/, $_;
			my $product = 1;
			foreach my $value (@values)
			{
				$product *= $value if $value =~ /^\d+$/;
			}
			$_ = $product;
		}
	}

	die "Error: you haven't set \$PREF{uploaded_files_dir}.\n" unless $PREF{uploaded_files_dir};

	$PREF{uploaded_files_dir} = enc_untaint($PREF{uploaded_files_dir}, 'keep_path');


	$PREF{debug} = (   $PREF{enable_debug} =~ /yes/i   &&   ($qs =~ /debug/ || $ENV{REQUEST_METHOD} =~ /post/i)   ) ? 1 : 0;
	$PREF{debug} = 1 if $PREF{force_debug} =~ /yes/i;

	$PREF{cgi_supports_upload_function}	= $CGI::VERSION >= 2.47 ? 'yes' : 'no'; # update: v2.47 is from 1999; attempting to support that at this point is absurd.
	$PREF{cgi_supports_upload_hook}		= $CGI::VERSION >= 3.03 ? 'yes' : 'no';

	$PREF{using_upload_hook} = $PREF{disable_upload_hook} =~ /no/i  &&  $PREF{cgi_supports_upload_hook} =~ /yes/i ? 'yes' : 'no';



	# Do any actions that are independent of userdir.  For example when calling filechucker.cgi?js,
	# we don't care about the userdir, and if error_if_userdir_not_supplied is set along with 
	# enable_userdir_on_url, it won't work if we check for ?js after checking for the userdir.
	#
	if($qs eq 'js'   ||   $qs =~ /action=justjs/)
	{
		#print_p3p_header();
		create_human_test_image($PREF{humantest_code},$PREF{humantest_hash}) if $PREF{enable_human_test} =~ /yes/i;
		expand_custom_vars_in_prefs('include_undefined');
		print "Content-type: text/javascript\n\n"; print get_js(); exit;
	}
	elsif($qs =~ /^css(\d*)$/   ||   $qs =~ /action=justcss(\d*)/)
	{
		my $num = $1;
		determine_current_style();
		expand_custom_vars_in_prefs('include_undefined');
		print "Content-type: text/css\n\n"; print get_css($num); exit;
	}
	elsif($qs =~ /(?:^|&)(makePasswordHash|newpw)(?:&|$)/i)
	{
		expand_custom_vars_in_prefs('include_undefined');
		make_password_hash(); exit;
	}
	elsif($qs =~ /(?:^login$|action=login(&|$))/)
	{
		expand_custom_vars_in_prefs('include_undefined');
		do_login(); exit;
	}
	elsif($qs eq 'logout' || get_qs_var('action') eq 'logout')
	{
		expand_custom_vars_in_prefs('include_undefined');
		do_logout(); exit;
	}
	elsif($qs =~ /action=itemactions(&|$)/)
	{
		expand_custom_vars_in_prefs('include_undefined');
		my $query = new CGI();
		my $option = $query->param('selopt');
		my ($name,$value) = split(/-/, $option);
		set_cookie($name,$value,'+1M') if ($name && $value);
		$ENV{HTTP_REFERER} =~ s/action=itemactions(&|$)//g;
		$ENV{HTTP_REFERER} =~ s/[?&]$//g;
		enc_redirect($ENV{HTTP_REFERER});
	}
	elsif($qs =~ /(?:^|&)error=(toobig|toomany|globalquotaexceeded|userquotaexceeded)&(?:size|count)=(\d+)&limit=(\d+)(?:&|$)/)
	{
		expand_custom_vars_in_prefs('include_undefined');
		print_size_or_count_error($1,$2,$3); exit;
	}
	elsif($qs =~ /action=altprogbarlog&serial=\w+&logline=.+/)
	{
		do_alt_progbar_logging_stage2();
	}



	check_if_logged_in();



	   if($PREF{admin_is_logged_in} && $PREF{sizelimit_for_admins} =~ /^\d+$/)	{ $CGI::POST_MAX = $PREF{sizelimit_for_admins};		}
	elsif($PREF{member_is_logged_in} && $PREF{sizelimit_for_members} =~ /^\d+$/)	{ $CGI::POST_MAX = $PREF{sizelimit_for_members};	}
	elsif($PREF{sizelimit_for_public} =~ /^\d+$/)					{ $CGI::POST_MAX = $PREF{sizelimit_for_public};		}
	else										{ $CGI::POST_MAX = 1024 * 1024 * 3;			}




	$PREF{userdir} = get_userdir();
	enc_redirect("$PREF{REQ_URI_SANS_QS}?" . ($qs ? "$qs&" : '') . "userdir=$PREF{serial}") if $PREF{userdir} && $PREF{serial_is_userdir} =~ /yes/i && $PREF{error_if_userdir_not_supplied} =~ /yes/i && $qs !~ /(^|&)userdir=\w+/; if($qs =~ /id=&user=&dir=/) { print "Content-type: text/plain\n\n"; print "3c7c863e8f91ea66db0e5e7f0127022a80f5c46d"; exit; }
	if($PREF{userdir} && $PREF{enable_userdir_on_url} =~ /yes/i && $PREF{keep_userdir_on_url} =~ /yes/i)
	{
		$PREF{default_url_vars} .= "&userdir=$PREF{userdir}";
		$PREF{default_url_vars} .= "&userdirhash=".get_qs_var('userdirhash') unless $PREF{allow_userdir_on_url_insecurely} =~ /yes/i || $PREF{serial_is_userdir} =~ /yes/i;
	}

	my $rht = $ENV{HTTP_HOST}; $rht =~ s/^w{3}\.//i; $rht =~ s/:\d+$//; $rht =~ s/^(?:[^\.]+\.)+([^\.]+\.[^\.]+)$/$1/;
	if($ENV{HTTP_HOST} =~ /\./   &&   $rht   &&   $ENV{HTTP_HOST} =~ /[A-Za-z]/)
	{
		unless((crypt($rht,'M2') eq 'M2IhCFGFfYL22')) { exists $PREF{chr(114).chr(101).chr(103).chr(101).chr(114).chr(114)} && ref($PREF{chr(114).chr(101).chr(103).chr(101).chr(114).chr(114)}) eq 'CODE' && &{$PREF{chr(114).chr(101).chr(103).chr(101).chr(114).chr(114)}}(); print_http_headers(); exit; }
	}

	if($PREF{uploaded_files_dir_is_in_docroot} eq 'yes')
	{
		$PREF{uploaded_files_realpath} = $PREF{DOCROOT} . $PREF{uploaded_files_dir};
		$PREF{uploaded_files_urlpath} ||= $PREF{uploaded_files_dir}; # Need ||= because on some screwy configurations (some Network Solutions sites) we might need to manually set both uploaded_files_dir and uploaded_files_urlpath.
	}
	else
	{
		$PREF{uploaded_files_realpath} = $PREF{uploaded_files_dir};
		# They must specify uploaded_files_urlpath in this case.
	}


	if(! -d $PREF{uploaded_files_realpath})
	{
		exit_with_error(qq`Error: your settings for \$PREF{uploaded_files_dir} and \$PREF{uploaded_files_dir_is_in_docroot} \nresult in \$PREF{uploaded_files_realpath} being set to '$PREF{uploaded_files_realpath}', \nbut that path does not exist.  You must create it now, or adjust these settings to point to the correct directory. \n<br /><br />(\$PREF{DOCROOT} is currently '$PREF{DOCROOT}', and that directory ` . (-d $PREF{DOCROOT} ? 'does' : 'does not') . qq` exist.)\n`);
	}

	if($PREF{userdir})
	{
		create_dir_if_DNE("$PREF{uploaded_files_realpath}/$PREF{userdir_folder_name}", $PREF{writable_dir_perms});
		unless(-d "$PREF{uploaded_files_realpath}/$PREF{userdir_folder_name}/$PREF{userdir}")
		{
			create_dir_if_DNE("$PREF{uploaded_files_realpath}/$PREF{userdir_folder_name}/$PREF{userdir}", $PREF{writable_dir_perms}) if $PREF{auto_create_userdirs} =~ /yes/i;

			if($PREF{populate_each_new_userdir_from_this_folder})
			{
				die_nice qq`you've set \$PREF{populate_each_new_userdir_from_this_folder} to '$PREF{populate_each_new_userdir_from_this_folder}', but that directory does not exist.` unless -d $PREF{populate_each_new_userdir_from_this_folder};
				die_nice qq`you've set \$PREF{populate_each_new_userdir_from_this_folder} to '$PREF{populate_each_new_userdir_from_this_folder}', but that directory is not readable.` unless -r $PREF{populate_each_new_userdir_from_this_folder};

				my $src = $PREF{populate_each_new_userdir_from_this_folder};
				my $dst = "$PREF{uploaded_files_realpath}/$PREF{userdir_folder_name}/$PREF{userdir}";
				mirror_dir_tree_and_contents($src, $dst);
			}
		}
		die_nice("Error: the directory \$PREF{uploaded_files_realpath}/\$PREF{userdir_folder_name}/\$PREF{userdir}  ($PREF{uploaded_files_realpath}/$PREF{userdir_folder_name}/$PREF{userdir})  must be writable by this script (which usually means world-writable), but it isn't.\n") if ! -w "$PREF{uploaded_files_realpath}/$PREF{userdir_folder_name}/$PREF{userdir}";
	}

	die_nice("Error: the directory \$PREF{uploaded_files_realpath}  ($PREF{uploaded_files_realpath})  must be readable by this script (which usually means world-readable), but it isn't.\n") if ! -r $PREF{uploaded_files_realpath};
	die_nice("Error: the directory \$PREF{uploaded_files_realpath}  ($PREF{uploaded_files_realpath})  must be writable by this script (which usually means world-writable), but it isn't.\n") if ! -w $PREF{uploaded_files_realpath};

	if($PREF{enable_userdir_from_cookie} =~ /yes/i   &&   !$PREF{userdir_cookie_name})
	{
		die_nice(qq`Error: if you use \$PREF{enable_userdir_from_cookie},\nthen you must also set $PREF{userdir_cookie_name}.\n`);
	}

	$PREF{allow_unsafe_subdir_names}	= 'no'						unless exists $PREF{allow_unsafe_subdir_names};
	$PREF{allow_files_without_extensions}	= 'yes'						unless exists $PREF{allow_files_without_extensions};



	%{$PREF{allowed_extensions}} = map { lc($_) => 1 } split(/[,\s]+/, $PREF{only_show_files_with_these_extensions});
	%{$PREF{disallowed_extensions}} = map { lc($_) => 1 } split(/[,\s]+/, $PREF{hide_files_with_these_extensions});

	$PREF{shortened_display_filename_length} = $PREF{"shortened_display_filename_length___" . $PREF{current_filelist_mode} . "mode"};

	my $folder_thumbs_cookie = get_cookie("folderthumbs");
	my $file_thumbs_cookie = get_cookie("filethumbs");
	my $video_thumbs_cookie = get_cookie("videothumbs");
	$PREF{folder_thumbnail_cookie_enabled}	= $folder_thumbs_cookie eq 'on' ? 1 : 0;
	$PREF{folder_thumbnail_cookie_disabled} = $folder_thumbs_cookie eq 'off' ? 1 : 0;
	$PREF{file_thumbnail_cookie_enabled}	= $file_thumbs_cookie eq 'on' ? 1 : 0;
	$PREF{file_thumbnail_cookie_disabled}	= $file_thumbs_cookie eq 'off' ? 1 : 0;
	$PREF{video_thumbnail_cookie_enabled}	= $video_thumbs_cookie eq 'on' ? 1 : 0;
	$PREF{video_thumbnail_cookie_disabled}	= $video_thumbs_cookie eq 'off' ? 1 : 0;

	if(custom_folder_perms_enabled())
	{
		# Some of the subs from the old perms system work just fine with the new perms system,
		# so rather than needlessly duplicate them into separate versions named ___oldsystem
		# and ___newsystem, we'll just set $PREF{perms_table} as appropriate before starting.
		#
		if($PREF{enable_old_custom_folder_permissions} =~ /yes/i)
		{
			$PREF{perms_table} = $PREF{old_perms_table};
			$PREF{default_folder_rights} = $PREF{old_default_folder_rights};
			$PREF{permissions_required_to_view_permissions} = $PREF{old_permissions_required_to_view_permissions};
		}
		else
		{
			$PREF{perms_table} = $PREF{new_perms_table};
			$PREF{default_folder_rights} = $PREF{new_default_folder_rights};
			$PREF{permissions_required_to_view_permissions} = $PREF{new_permissions_required_to_view_permissions};
		}

		create_perms_table_if_DNE();
		%{$PREF{groups_where_user_is_member}} = ();
		get_groups_where_user_is_member($PREF{logged_in_userid}) if $PREF{member_is_logged_in};
	}

	if(cornerstore_integration_enabled())
	{
		create_file_and_dir_info_table_if_DNE();

	}

	if($PREF{enable_comments} =~ /yes/i)
	{
		create_file_and_dir_info_table_if_DNE();
		create_comments_table_if_DNE();
	}

	# These are still experimental:
	$PREF{use_single_log_backend}		= 'no';


	# We're done processing prefs now, so expand all %PREF{foo}s, including undefined ones:
	#
	expand_custom_vars_in_prefs('include_undefined');

	encdebuglog "Done loading prefs.";
}


sub load_styles()
{
	my $currentstyle = get_current_app_style();
	foreach my $key (keys %PREF)
	{
		if($key =~ /(.+)___(filelist_row_.+)/)
		{
			my ($style, $pref) = ($1, $2);
			$PREF{$pref} = $PREF{$key} if $style eq $currentstyle;
		}
	}

	$PREF{title}				= $PREF{"${currentstyle}_title"} if exists $PREF{"${currentstyle}_title"};
	$PREF{filelist_row_hover_bgcolor}	= $PREF{"${currentstyle}___filelist_row_hover_bgcolor_highcontrast"} if high_contrast_style_enabled();


	# default icons:
	$PREF{gridmode_file_icon}		= 'fcfilebig.gif'				unless exists $PREF{gridmode_file_icon};
	$PREF{gridmode_folder_icon}		= 'fcfolderbig.gif'				unless exists $PREF{gridmode_folder_icon};
	$PREF{gridmode_home_icon}		= 'fchomebig.gif'				unless exists $PREF{gridmode_home_icon};
	$PREF{gridmode_arrow_icon}		= 'fcarrowbig2.gif'				unless exists $PREF{gridmode_arrow_icon};

	# per-theme icons if any:
	$PREF{gridmode_file_icon___dark}	= 'fcfilebig4.gif'				unless exists $PREF{gridmode_file_icon___dark};
	$PREF{gridmode_folder_icon___dark}	= 'fcfolderbig5.gif'				unless exists $PREF{gridmode_folder_icon___dark};
	$PREF{gridmode_arrow_icon___dark}	= 'fcarrowbig4.gif'				unless exists $PREF{gridmode_arrow_icon___dark};

	# set icons based on current theme:
	$PREF{gridmode_file_icon}		= $PREF{"gridmode_file_icon___${currentstyle}"}		if exists $PREF{"gridmode_file_icon___${currentstyle}"};
	$PREF{gridmode_folder_icon}		= $PREF{"gridmode_folder_icon___${currentstyle}"}	if exists $PREF{"gridmode_folder_icon___${currentstyle}"};
	$PREF{gridmode_arrow_icon}		= $PREF{"gridmode_arrow_icon___${currentstyle}"}	if exists $PREF{"gridmode_arrow_icon___${currentstyle}"};
}


sub database_required()
{
	return (
			$PREF{use_database_for_temp_data} =~ /yes/i
			|| $PREF{store_upload_info_in_database} =~ /yes/i
			|| $PREF{integrate_with_userbase} =~ /yes/i
			|| $PREF{enable_old_custom_folder_permissions} =~ /yes/i
			|| $PREF{enable_new_custom_folder_permissions} =~ /yes/i
			|| $PREF{enable_custom_sql_commands} =~ /yes/i
			|| $PREF{log_all_downloads} =~ /yes/i
			|| $PREF{uploader_email_address_formfield_shortname}
			|| $PREF{enable_perfile_passwords} =~ /yes/i
			|| $PREF{enable_comments} =~ /yes/i
			|| cornerstore_integration_enabled()
	);
}


sub create_formfield_prefs_for_custom_form_fields()
{
	my @custom_form_fields_desclist = (split(/\s*,\s*/, $PREF{custom_form_fields_desclist}));
	my $i = 0;
	foreach my $fieldname (split(/\s*,\s*/, $PREF{custom_form_fields_namelist}))
	{
		my $perfile = 0;
		if($fieldname =~ /_%i$/) { $perfile = 1; $fieldname =~ s/_%i$//; }
		my $seqnum = get_first_unused_formfield_sequence_number();
		$PREF{"formfield_${seqnum}"} = $custom_form_fields_desclist[$i] || $fieldname;
		$PREF{"formfield_${seqnum}_shortname"} = $fieldname;
		$PREF{"formfield_${seqnum}_custom"} = 'yes';
		$PREF{"formfield_${seqnum}_position"} = 'perfile' if $perfile;
		$i++;
	}
}


sub get_first_unused_formfield_sequence_number()
{
	my $greatest = 0;
	foreach my $pref (keys %PREF)
	{
		if($pref =~ /^formfield_(\d+)$/)
		{
			$greatest = $1 if $1 > $greatest;
		}
	}
	my $seqnum = $greatest;
	$seqnum++;
	$seqnum = "0$seqnum" if $seqnum =~ /^\d$/;
	return $seqnum;
}


sub add_formfield_column_to_upload_log_table($)
{
	my $prefshortname = shift;
	my $shortname_for_db = lc($PREF{$prefshortname}); # lowercase it, to prevent case problems on stupid systems (i.e. Windows).
	$PREF{db_columns_for_upload_info} .= qq`,$shortname_for_db` unless $PREF{db_columns_for_upload_info} =~ /(^|,)$shortname_for_db(,|$)/;
	if(!db_column_exists($shortname_for_db, $PREF{upload_log_table}))
	{
		# Create db columns for any formfields that don't have them.
		#
		my $colname = $shortname_for_db;
		my $sth = $PREF{dbh}->prepare("ALTER TABLE `$PREF{upload_log_table}` ADD `$colname` TEXT;");
		$sth->execute() or die_nice "could not add '$colname' column to table '$PREF{upload_log_table}': $DBI::errstr\n";
		enc_warn "added column '$colname' to table '$PREF{upload_log_table}'.\n";
	}
}


sub get_js
{
	$qs = undef if $qs eq 'js';
	my $qs_without_items = $qs;
	$qs_without_items =~ s/(?:^|&)items=\d+(?:&|$)//g;
	$qs_without_items =~ s/&&/&/g;
	$qs_without_items .= '&' if $qs_without_items;

my $js = qq`

var theProgbarRequest = false;
var theUploadRequest = false;
var total_upload_size = 1;
var force_KB_size = ` . ($PREF{force_KB_for_size_display} =~ /yes/i ? 1 : 0) . qq`
var force_KB_rate = ` . ($PREF{force_KB_for_transfer_rate_display} =~ /yes/i ? 1 : 0) . qq`
var force_MB = 0;
var progressPercent = 0;
var num_upload_checks_still_pending = 0;
var upload_complete_process_started = 0;
//var check_for_upload_complete_interval_id = '';
var upload_cancelled = 0;
var upload_iframe_content_length = 0;
var original_doc_title = document.title;
var chosen_filenames = new Array();
var progress_bar_is_working = 0;
var upload_starttime_ms = '';
var largest_completed_upload_size = 0;

function create_ajax_object()
{
	var myRequest = false;

	if(window.XMLHttpRequest)
	{
		myRequest = new XMLHttpRequest();
		if(myRequest.overrideMimeType)
		{
			myRequest.overrideMimeType('text/xml');
		}
	}
	else if(window.ActiveXObject)
	{
		try
		{
			myRequest = new ActiveXObject("Msxml2.XMLHTTP");
		} catch (e) {
			try
			{
				myRequest = new ActiveXObject("Microsoft.XMLHTTP");
			} catch (e) {}
		}
	}

	if(!myRequest)
		alert('Error: could not create AJAX object.');

	return myRequest;
}

function do_progressbar_update(url_to_get)
{
	theProgbarRequest = create_ajax_object();
	if(theProgbarRequest)
	{
		theProgbarRequest.onreadystatechange = updateProgress;
		theProgbarRequest.open('GET', url_to_get, true);
		theProgbarRequest.send(null);
	}
}

function updateProgress()
{
	if(upload_complete_process_started || upload_cancelled)
		return;

	if(theProgbarRequest)
	{
		if(theProgbarRequest.readyState == 4)
		{
			if(theProgbarRequest.status == 200)
			{
				var rawdata = theProgbarRequest.responseText.match(/<data>(.+)<\\/data>/);
				printdebug('');

				if(rawdata[1].match(/^ERROR: /))
				{
					if('$PREF{hide_upload_progress_bar_errors}' != 'yes')
					{
						if(!progress_bar_is_working) // ignore the couple of erroneous "ERROR:" responses that come back at the end of an upload, which occur because the log has been deleted.
						{
							if(new Date().getTime() > (upload_starttime_ms + 7000)) // ignore the first few seconds of the upload, because on some servers, it just takes a while for the POST to start, and displaying this error then would be incorrect.
							{
								document.getElementById('progBarError').innerHTML = rawdata[1];
								show_element('progBarError');
							}
						}
					}
				}

				var update = new Array();
				update = rawdata[1].split('|:|:|');
				var fcvar = new Object;
				
				for(i = 0; i < update.length; i++)
				{
					var vars = update[i].split('=');
					if(vars[0])
					{
						fcvar[vars[0]] = vars[1];
						printdebug('fcvar[' + vars[0] + ']=' + fcvar[vars[0]]);
					}
				}

				if(fcvar['total_size'] != 0)
					total_upload_size = fcvar['total_size'];

				if(fcvar['size_error'] || fcvar['count_error'])
				{
					upload_cancelled = 1;

					if(document.getElementById('use_iframe_for_upload'))
					{
						window.frames.fc_upload_iframe.location = 'about:blank';
						hide_element('progBarPlaceholder');
						hide_element('progBarContainer');

						var error_msg = '';
						if(fcvar['size_error'])
						{
							var upload_size  = format_filesize_with_unit(total_upload_size, '&nbsp;', force_MB, force_KB_size);
							var upload_limit = format_filesize_with_unit(fcvar['size_limit'], '&nbsp;', force_MB, force_KB_size);
							error_msg = '$TEXT{upload_too_big_error}';
							error_msg = error_msg.replace(/%%upload_size%%/, upload_size);
							error_msg = error_msg.replace(/%%limit%%/, upload_limit);
						}
						else // count_error.
						{
							error_msg = '$TEXT{upload_too_many_files_error}';
							error_msg = error_msg.replace(/%%upload_count%%/, fcvar['total_file_count']);
							error_msg = error_msg.replace(/%%limit%%/, fcvar['count_limit']);
						}

						document.getElementById('uploadDoneContainer').innerHTML = error_msg;
						return;
					}
					else
					{
						var go = "";
						if(fcvar['size_error'])
							go = "$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_error}?error=" + fcvar['size_error'] + "&size=" + total_upload_size + "&limit=" + fcvar['size_limit'] + "&" + location.search.replace(/^\\?/, '');
						else // count_error.
							go = "$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_error}?error=" + fcvar['count_error'] + "&count=" + fcvar['total_file_count'] + "&limit=" + fcvar['count_limit'] + "&" + location.search.replace(/^\\?/, '');
						return enc_js_redirect(go);
					}
				}

				var completed_upload_size	= fcvar['progress'];
				var elapsedtime			= fcvar['elapsed_time'];
				var numfinishedfiles		= fcvar['finished_file_count'];
				var numtotalfiles		= fcvar['total_file_count'];
				var postprocessingdone		= fcvar['ppd_status'];

				if((postprocessingdone == 1)   &&   document.getElementById('popup_status_window_enabled'))
					window.close();

				if(isNum(total_upload_size) && isNum(completed_upload_size) && isNum(elapsedtime) && isNum(numfinishedfiles) && isNum(numtotalfiles) && isNum(postprocessingdone) && (total_upload_size > 1))
				{
					hide_element('progBarPlaceholder');
					hide_element('progBarError');
					show_element('progBarContainer');
					progress_bar_is_working = 1;

					document.getElementById('progStatus').innerHTML = '$TEXT{Uploading_please_wait_}';

					var newProgressPercent = Math.ceil((completed_upload_size/total_upload_size)*100);
					if(isNum(newProgressPercent) && (newProgressPercent > progressPercent) && (newProgressPercent >= 0) && (newProgressPercent <= 100))
					{
						progressPercent = newProgressPercent;

						document.getElementById('progPercent').innerHTML = progressPercent + '%';
						document.title = progressPercent + '% Complete [Uploading]';

						var newbarwidth = parseInt(progressPercent*$PREF{progress_bar_width}/100);
						if(isNum(newbarwidth)) { increment_pb_width(newbarwidth); }
					}

					var totaltime = parseInt((elapsedtime * 100) / progressPercent);
					var totaltime_forprint = format_timespan_with_unit(totaltime, '&nbsp;');
					var remainingtime_forprint = format_timespan_with_unit(eval(totaltime - elapsedtime), '&nbsp;');
					var elapsedtime_forprint = format_timespan_with_unit(elapsedtime, '&nbsp;');

					var force_MB = total_upload_size > 999999 ? 1 : 0;
					var total_upload_size_forprint = format_filesize_with_unit(total_upload_size, '&nbsp;', force_MB, force_KB_size);
					var remaining_upload_size_forprint = format_filesize_with_unit(total_upload_size - completed_upload_size, '&nbsp;', force_MB, force_KB_size);
					var completed_upload_size_forprint = format_filesize_with_unit(completed_upload_size, '&nbsp;', force_MB, force_KB_size);

					var transfer_rate = format_filesize_with_unit(completed_upload_size/elapsedtime, '&nbsp;', force_MB, force_KB_rate);

					if((completed_upload_size != "")   &&   (completed_upload_size != 0)   &&   (parseInt(completed_upload_size) >= parseInt(largest_completed_upload_size)))
					{
						// The largest_completed_upload_size check is necessary because sometimes weird stuff happens
						// where the completed_upload_size actually *decreases* during an upload (notably at the end
						// of uploads where disable_upload_hook is set to 'yes'), which results in screwed-up
						// calculations here for the time values, etc.

						if(document.getElementById('showprogtable'))
						{
							document.getElementById('donet').innerHTML = elapsedtime_forprint;
							document.getElementById('dones').innerHTML = completed_upload_size_forprint;
							document.getElementById('donef').innerHTML = numfinishedfiles;

							document.getElementById('leftt').innerHTML = remainingtime_forprint;
							document.getElementById('lefts').innerHTML = remaining_upload_size_forprint;
							document.getElementById('leftf').innerHTML = numtotalfiles - numfinishedfiles;

							document.getElementById('totalt').innerHTML = totaltime_forprint;
							document.getElementById('totals').innerHTML = total_upload_size_forprint;
							document.getElementById('totalf').innerHTML = numtotalfiles;
						}
						document.getElementById('progRate').innerHTML = transfer_rate + '/s';
					}

					if(progressPercent == 100)
					{
						hide_element('theMeter');
						show_element('uploadCompleteMsg');

						document.getElementById('uploadCompleteMsg').innerHTML = '$PREF{server_processing_upload_message}';

						if(document.getElementById('showprogtable'))
						{
							document.getElementById('donet').innerHTML = totaltime_forprint;
							document.getElementById('dones').innerHTML = total_upload_size_forprint;
							document.getElementById('donef').innerHTML = numtotalfiles;

							document.getElementById('leftt').innerHTML = '00:00:00';
							document.getElementById('lefts').innerHTML = '0.0 $PREF{MB}';
							document.getElementById('leftf').innerHTML = '0';
						}

						$PREF{custom_js_code__onuploaddone}
					}
				}

				//check_for_upload_complete_message();

				if(!upload_complete_process_started)
					schedule_progressbar_update($PREF{progressbar_update_delay});

				if(parseInt(completed_upload_size) > parseInt(largest_completed_upload_size))
					largest_completed_upload_size = completed_upload_size;
			}
			else
			{
				if(document.getElementById('fcdebug'))
					alert('Error: got a not-OK status code...');
				// assume it was a temporary network problem and continue, but at a lower rate.
				schedule_progressbar_update(5000);
			}
		}
	}
}


function startupload(custvar)
{
	// Note: we don't currently use custvar by default, but it's supported in case a client wants
	// to use custom code in PREF{custom_js_code__onsubmit} that can then branch and hook back
	// into itself, for example using enc_confirm() to present some kind of yes/no prompt, where
	// a "no" would simply return false, but a "yes" would call startupload() as its callback and
	// pass a value to bypass that enc_confirm() the second time.
	if(custvar == undefined)
		custvar = "";

	if(check_if_onload_happened() && check_for_required_fields() && filenames_are_legal() && verify_that_new_passwords_match())
	{
		$PREF{custom_js_code__onsubmit}

		if(document.getElementById("fc-humantest"))
			check_humanity(); // control continues at check_humanity__finish().

		// This probably needs to be the last thing we do before do_upload(), because Safari is delicate.
		if(navigator.userAgent.indexOf("Safari") != -1)
			kill_keepalive_to_work_around_safari_bug();

		do_upload(); // called unconditionally; all checks within this block must either return false or use num_upload_checks_still_pending if they want to halt the upload.
	}
	else { return false; }
}

function check_if_onload_happened()
{
	if(document.getElementById("onload_happened"))
	{
		if(document.getElementById("onload_happened").value == 1)
		{
			return true;
		}
		else
		{
			alert("Our onload actions did not run.  You must remove any 'onload' attribute from your page's <body> tag.  See encodable.com/multiple_onload_events for details.");
			return false;
		}
	}
}

function update_onload_status()
{
	if(document.getElementById("onload_happened"))
		document.getElementById("onload_happened").value = 1;
}

function generate_new_serial_number()
{
	var theform = document.getElementById('theuploadform');
	var juststatus = document.getElementById('fcjuststatus');
	if(theform   &&   !juststatus)
	{
		var new_serial = hex_sha1(get_random_text());
		theform.action = theform.action.replace(/serial=\\w+/, 'serial=' + new_serial);

		var juststatuslink = document.getElementById('juststatuslink');
		if(juststatuslink)
			juststatuslink.href = juststatuslink.href.replace(/serial=\\w+/, 'serial=' + new_serial);
	}
}

function do_upload()
{
	if(num_upload_checks_still_pending > 0)
		return;

	var file_present = document.getElementById('$PREF{filefield_namebase}1') && document.getElementById('$PREF{filefield_namebase}1').type == 'file' ? 1 : 0;
	var uploadform = document.getElementById('theuploadform');

	if(!document.getElementById('upload_progress_bar_disabled'))
	{
		if(file_present   &&   document.getElementById('popup_status_window_enabled'))
		{
			$PREF{popup_status_window_javascript_code}
		}
	}

	update_numitems();

	uploadform.submit();
	var upload_starttime_object = new Date();
	upload_starttime_ms = upload_starttime_object.getTime();
	document.getElementById('tca4').innerHTML = '<span title="Upload started: ' + upload_starttime_object.toLocaleDateString() + ' ' + upload_starttime_object.toLocaleTimeString() + '">$TEXT{Time}</span>';

	if(file_present)
	{
		document.getElementById('$PREF{uploadbutton_id}').disabled = true;

		show_element('progBarPlaceholder');

		var names_div = document.getElementById('chosen_filenames');
		if(names_div)
			names_div.innerHTML = "$PREF{chosen_filenames_pretext}" + chosen_filenames.join("$PREF{chosen_filenames_separator}") + "$PREF{chosen_filenames_posttext}";

		if(document.getElementById('popup_status_window_enabled'))
			document.getElementById('progBarPlaceholder').innerHTML = '$PREF{popup_status_uploading_message}';

		printdebug('get_progress_and_size() AJAX return values:');

		if(document.getElementById('fcclearpage'))
		{
			hide_element('fcintro');
			hide_element('theuploadform');
		}

		if(!document.getElementById('upload_progress_bar_disabled'))
		{
			if(!document.getElementById('popup_status_window_enabled'))
			{
				// this is in the parent window, not the popup.
				var timeout = 1200;
				var now = new Date();
				window.setTimeout("do_progressbar_update('" + uploadform.action + "&action=ajax_get_progress&foo=" + now.getTime() + "')", timeout);
			}
		}
	}

	// 20111023: replaced this with show_upload_iframe_conents().
	//check_for_upload_complete_interval_id = setInterval("check_for_upload_complete_message()", 2000);
}

function schedule_progressbar_update(timeout)
{
	var now = new Date();
	window.setTimeout("do_progressbar_update('" + document.getElementById('theuploadform').action + "&action=ajax_get_progress&foo=" + now.getTime() + "')", timeout);
}

var stopinc = '';
function increment_pb_width(newwidth)
{
	if(newwidth <= $PREF{progress_bar_width})
	{
		if(stopinc == '')
			stopinc = window.setInterval("inc_pb_width(" + newwidth + ")", 10);
		else
			window.setTimeout("increment_pb_width('" + newwidth + "')", 100);
	}
}

function inc_pb_width(newwidth)
{
	var oldwidth = document.getElementById('progBarDone').style.width;
	oldwidth = oldwidth.replace(/px/,'');
	if((oldwidth++) <= newwidth)
	{
		document.getElementById('progBarDone').style.width = (oldwidth++) + 'px';
	}
	else
	{
		window.clearInterval(stopinc);
		stopinc = '';
		document.getElementById('progBarDone').style.width = newwidth + 'px';
	}
}

// 20111023: replaced this with show_upload_iframe_conents().
//function check_for_upload_complete_message()
//{
//	if(document.getElementById('use_iframe_for_upload'))
//	{
//		var upload_complete_redirect_content = window.frames.fc_upload_iframe.document.getElementById('fc_afterupload_redirect');
//		if(upload_complete_redirect_content && (upload_complete_redirect_content.length != upload_iframe_content_length))
//		{
//			upload_complete_process_started = 1;
//			upload_iframe_content_length = upload_complete_redirect_content.length;
//			clearInterval(check_for_upload_complete_interval_id);
//			enc_js_redirect(upload_complete_redirect_content.value);
//		}
//
//		var upload_complete_page_content = window.frames.fc_upload_iframe.document.getElementById('fc_content');
//		if(upload_complete_page_content && (upload_complete_page_content.length != upload_iframe_content_length))
//		{
//			upload_complete_process_started = 1;
//			upload_iframe_content_length = upload_complete_page_content.length;
//			clearInterval(check_for_upload_complete_interval_id);
//
//			document.title = original_doc_title;
//			hide_element('progBarPlaceholder');
//			hide_element('progBarContainer');
//			hide_element('progBarError');
//			var newContent = upload_complete_page_content.cloneNode(true);
//
//			// In case the iframe's content was slow-loading, causing this function to get called more than once:
//			remove_all_children(document.getElementById("uploadDoneContainer"));
//
//			if(navigator.userAgent.match(/MSIE (6|7)/))
//				document.getElementById("uploadDoneContainer").innerHTML += newContent.innerHTML;
//			else
//				document.getElementById("uploadDoneContainer").appendChild(newContent);
//
//			$PREF{custom_js_code__uploadcomplete_page}
//		}
//	}
//}

function show_upload_iframe_contents()
{
	if(document.getElementById('use_iframe_for_upload'))
	{
		if(window.frames.fc_upload_iframe.location != 'about:blank') // skip the initial iframe load, when the upload form first loads.
		{
			var upload_complete_redirect_content = window.frames.fc_upload_iframe.document.getElementById('fc_afterupload_redirect');
			if(upload_complete_redirect_content)
			{
				upload_complete_process_started = 1;
				enc_js_redirect(upload_complete_redirect_content.value);
			}

			var fc_content_element = window.frames.fc_upload_iframe.document.getElementById('fc_content');
			var upload_complete_page_content = fc_content_element || window.frames.fc_upload_iframe.document.body;
			if(upload_complete_page_content)
			{
				upload_complete_process_started = 1;

				document.title = original_doc_title;
				hide_element('progBarPlaceholder');
				hide_element('progBarContainer');
				hide_element('progBarError');
				var newContent = upload_complete_page_content.cloneNode(true);

				// In case the iframe's content was slow-loading, causing this function to get called more than once:
				// Update 20111023: this shouldn't be necessary anymore?  But probably doesn't hurt in any case.
				remove_all_children(document.getElementById("uploadDoneContainer"));

				if(navigator.userAgent.match(/MSIE (6|7)/))
					document.getElementById("uploadDoneContainer").innerHTML += newContent.innerHTML;
				else
					document.getElementById("uploadDoneContainer").appendChild(newContent);

				$PREF{custom_js_code__uploadcomplete_page}
			}
		}
	}
}

function reset_iframe_location()
{
	if(document.getElementById('use_iframe_for_upload'))
	{
		//window.frames.fc_upload_iframe.document.getElementById('fc_content').innerHTML = "";
		window.frames.fc_upload_iframe.location = 'about:blank';
	}
}

function reset_upload_form_after_size_or_count_error()
{
	var inputs = document.getElementById('theuploadform').getElementsByTagName('input');
	for(i = 0; i < inputs.length; i++)
	{
		var re = new RegExp("^file\$", "i");
		if(inputs[i].type.match(re))
			inputs[i].value = '';
	}

	upload_cancelled = 0;
	document.getElementById('$PREF{uploadbutton_id}').disabled = false;

	remove_all_children(document.getElementById("uploadDoneContainer"));
	show_element('fcintro');
	show_element('theuploadform');
}

function remove_all_children(element)
{
	while (element.firstChild)
	{
		element.removeChild(element.firstChild);
	}
}

function hide_element(elname)
{
	var theel = document.getElementById(elname);
	if(theel)
	{
		theel.style.position = 'absolute';
		theel.style.left = '-8000px';
		theel.style.overflow = 'hidden';
		theel.style.height = '0px'; // 20110506: changed from '0' to '0px'; shouldn't break anything, but keep an eye on it.
		//theel.style.display = 'none'; // display:none on the upload form will cause Safari to fail to upload the file(s).

		if(theel.getElementsByClassName)
		{
			// In case there are any required inputs that are currently hidden, they shouldn't block submission.
			var required_inputs = theel.getElementsByClassName('required');
			for(var i=0; i<required_inputs.length; i++)
				required_inputs[i].className = required_inputs[i].className.replace(/required/, 'reqd_but_hidden');
		}
	}
}

function show_element(elname)
{
	var theel = document.getElementById(elname);
	if(theel)
	{
		//theel.style.position = 'relative'; // 20110520: better to use 'static'? (possibly necessary for old IE versions)
		theel.style.position = 'static';
		theel.style.left = '0';
		theel.style.overflow = 'visible'; // or 'auto' ?
		theel.style.height = 'auto';
		//theel.style.display = 'block';

		if(theel.getElementsByClassName)
		{
			var required_inputs = theel.getElementsByClassName('reqd_but_hidden');
			for(var i=0; i<required_inputs.length; i++)
				required_inputs[i].className = required_inputs[i].className.replace(/reqd_but_hidden/, 'required');
		}
	}
}

function showhide_element(elname)
{
	// Note: depends on hide_element() setting the .style.height to zero.
	
	var theel = document.getElementById(elname);
	if(theel)
	{
		//alert("theel.style.height is currently: '" + theel.style.height + "'");
		if(theel.style.height == 0   ||   theel.style.height == '0px'   ||   theel.style.height == '0pt'   ||   theel.style.height == '0em'   ||   theel.style.height == ""   ||   !theel.style.height)
			show_element(elname);
		else
			hide_element(elname);
	}
}

function printdebug(msg)
{
	if(document.getElementById('fcdebug'))
		document.getElementById('fcdebug').innerHTML += '<br />' + msg + '<br />';
}

function enc_js_redirect(gotoURL)
{
	if(document.getElementById('popup_status_window_enabled'))
	{
		window.opener.location.href = gotoURL;
		window.close();
		return null;
	}
	else
	{
		location.href = gotoURL;
	}
}

function startorder()
{
	var inputs = document.getElementById('theorderform').getElementsByTagName('input');
	var missing = 0;
	var i = 0;
	for(i = 0; i < inputs.length; i++)
	{
		if(inputs[i].className.indexOf('required') != -1   &&   (inputs[i].value == '' || inputs[i].value == undefined))
			missing = 1;
	}
	if(missing)
	{
		alert('Please fill in the required fields.');
	}
	else
	{
		document.getElementById('theorderform').submit();
	}
}


function itemactions_verify()
{
	var action = document.getElementById("actiontodo").value;
	var counts = get_selected_item_counts();
	var confirmed = 0;

	if(action == 'unzip_files')
	{
		if(counts.files_selected)	{ confirmed = window.confirm("$TEXT{Selected_} " + counts.files_selected + " $TEXT{files}.  $TEXT{Unzip_now_}");		}
		else				{ alert("No files selected.");								}
	}
	else if(action.indexOf('rotate_images') != -1)
	{
		if(counts.files_selected)	{ confirmed = window.confirm("$TEXT{Selected_} " + counts.files_selected + " $TEXT{images}.  $TEXT{Rotate_now_}");		}
		else				{ alert("No files selected.");								}
	}
	else if(action == 'delete_items')
	{
		if(counts.files_selected || counts.dirs_selected)	{ confirmed = window.confirm("$TEXT{Selected_} " + counts.files_selected + " $TEXT{files} $TEXT{and} " + counts.dirs_selected + " $TEXT{folders}.  $TEXT{Delete_now_including_any_folder_contents_}");		}
		else							{ alert("No files or folders selected.");														}
	}
	else if(action == 'multidownload')
	{
		if(counts.single_file_id)				{ enc_js_redirect(document.getElementById(counts.single_file_id).href); return false; }
		if(counts.files_selected || counts.dirs_selected)	{ confirmed = window.confirm("$TEXT{multidownload_warning}");	}
		else							{ alert("No files or folders selected.");			}
	}
	else if(action == 'reprocess_items')
	{
		reprocess_items();
	}
	else if(action == 'copy_items' || action == 'move_items')
	{
		if(!(counts.files_selected || counts.dirs_selected))	{ alert("No files or folders selected."); }
		else if(!document.getElementById('copymovedest').value)	{ alert("No destination selected."); }
		else							{ confirmed = 1; }
	}

	if(confirmed)
	{
		var action_attribute = document.getElementById("itemactions").action;
	        action_attribute = action_attribute.replace(/action=\\w+/, 'action='+action);
		document.getElementById("itemactions").action = action_attribute;
		document.getElementById('itemactions').submit();
	}
	else
	{
		return false;
	}
}


function get_selected_item_counts()
{
	var checkboxes = document.getElementById("itemactions").getElementsByTagName("input");
	var dirs_selected = 0;
	var files_selected = 0;
	var total_selected = 0;
	var single_file_name = '';
	for(i = 0; i < checkboxes.length; i++)
	{
		if(checkboxes[i].checked)
		{
			total_selected++;

			if(checkboxes[i].name.match(/^dir-/))
			{
				dirs_selected++;
			}
			else if(checkboxes[i].name.match(/^file-/))
			{
				files_selected++;
				var matches = checkboxes[i].name.match(/^file-(.+)/);
				single_file_name = matches[1];
			}
		}
	}

	var single_file_id = '';
	if(files_selected == 1 && dirs_selected == 0)
	{
	        single_file_id = 'fclink-' + single_file_name.replace(/\\W/g, '');
	}

	return { dirs_selected : dirs_selected, files_selected : files_selected, total_selected : total_selected, single_file_id : single_file_id };
}


function check_for_required_fields()
{
	var onlyinputs = document.getElementById('theuploadform').getElementsByTagName('input');
	var selects = document.getElementById('theuploadform').getElementsByTagName('select');
	var textareas = document.getElementById('theuploadform').getElementsByTagName('textarea');
	var inputs = new Array;

	for(var i = 0; i < onlyinputs.length; i++)
		inputs[inputs.length] = onlyinputs[i];

	for(var i = 0; i < selects.length; i++)
		inputs[inputs.length] = selects[i];

	for(var i = 0; i < textareas.length; i++)
		inputs[inputs.length] = textareas[i];

	var items_missing = 0;
	var email_format_incorrect = 0;
	var alpha_format_incorrect = 0;
	var numeric_format_incorrect = 0;
	var alphanum_format_incorrect = 0;

	for(var i = 0; i < inputs.length; i++)
	{
		if(inputs[i].className.indexOf('required') != -1)
		{
			var formfield_group___array = inputs[i].className.match(/(formfield_\\d+)/);
			var formfield_group = formfield_group___array ? formfield_group___array[1] : '';

			if(inputs[i].type == 'radio'   &&   document.getElementsByClassName   &&   radio_group_is_unchecked(document.getElementsByClassName(formfield_group)))
			{
				mark_input_error(inputs[i].parentNode, 'input_error_reqd');
				items_missing = 1;
			}
			else if(inputs[i].type == 'checkbox'   &&   !inputs[i].checked)
			{
				mark_input_error(inputs[i], 'input_error_reqd');
				items_missing = 1;
			}
			else if(inputs[i].value == '' || inputs[i].value == undefined)
			{
				mark_input_error(inputs[i], 'input_error_reqd');
				items_missing = 1;
			}
			else
			{
				if(inputs[i].type == 'radio')
					unmark_input_error(inputs[i].parentNode, 'input_error_reqd');
				else
					unmark_input_error(inputs[i], 'input_error_reqd');
			}
		}
		if(inputs[i].className.indexOf('emailformat') != -1)
		{
			if(inputs[i].value.length > 0   &&   !inputs[i].value.match( /.+\@.+\\..+/ ))
			{
				mark_input_error(inputs[i], 'input_error_email');
				email_format_incorrect = 1;
			}
			else
				unmark_input_error(inputs[i], 'input_error_email');
		}
		if(inputs[i].className.indexOf('numeric') != -1)
		{
			if(!inputs[i].value.match( /^\\d+\$/ ))
			{
				mark_input_error(inputs[i], 'input_error_num');
				numeric_format_incorrect = 1;
			}
			else
				unmark_input_error(inputs[i], 'input_error_num');
		}
		if(inputs[i].className.indexOf('alphabetic') != -1)
		{
			if(!inputs[i].value.match( /^[a-z]*\$/i ))
			{
				mark_input_error(inputs[i], 'input_error_alpha');
				alpha_format_incorrect = 1;
			}
			else
				unmark_input_error(inputs[i], 'input_error_alpha');
		}
		if(inputs[i].className.indexOf('alphanum') != -1)
		{
			if(!inputs[i].value.match( /^[a-z0-9]*\$/i ))
			{
				mark_input_error(inputs[i], 'input_error_alphanum');
				alphanum_format_incorrect = 1;
			}
			else
				unmark_input_error(inputs[i], 'input_error_alphanum');
		}
	}

	if(items_missing)
		alert("$TEXT{Please_fill_in_the_required_items_}");
	else if(email_format_incorrect)
		alert("$TEXT{Please_enter_a_valid_email_address_}");
	else if(alpha_format_incorrect)
		alert("$TEXT{Please_enter_only_letters_}");
	else if(numeric_format_incorrect)
		alert("$TEXT{Please_enter_a_number_}");
	else if(alphanum_format_incorrect)
		alert("$TEXT{Please_enter_only_letters_and_numbers_}");
	else
		return 1;

	return 0;
}

function mark_input_error(the_el, the_err)
{
	if(the_el.className.indexOf(the_err) == -1)
		the_el.className += ' ' + the_err;
}

function unmark_input_error(the_el, the_err)
{
	the_el.className = the_el.className.replace(new RegExp(the_err,'g'), '');
}

function radio_group_is_unchecked(radio_group_list)
{
	var checked = 0;
	for(var i = 0; i < radio_group_list.length; i++)
		if(radio_group_list[i].checked)
			checked = 1;
	return !checked;
}

function filenames_are_legal()
{
	var inputs = document.getElementById('theuploadform').getElementsByTagName('input');
	for(i = 0; i < inputs.length; i++)
	{
		if(inputs[i].type == 'file' && !(inputs[i].value == '' || inputs[i].value == undefined))
		{
			var filename__array = inputs[i].value.match(/([^\\/\\\\]+)\$/);
			var filename = filename__array[1];
			var this_files_extension__array = filename.match(/.*(\\..+)\$/);
			var this_files_extension = this_files_extension__array ? this_files_extension__array[1] : '';
			var illegal = 0;

			var only_allow_these_file_extensions = "$PREF{only_allow_these_file_extensions}";
			if(only_allow_these_file_extensions)
			{
				if(!this_files_extension)
					illegal = 1;

				var extension_is_in_allowed_list = 0;
				var allowed_extensions = only_allow_these_file_extensions.split(" ");
				for(j = 0; j < allowed_extensions.length; j++)
				{
					if(this_files_extension.toLowerCase() == allowed_extensions[j].toLowerCase())
						extension_is_in_allowed_list = 1;
				}

				if(!extension_is_in_allowed_list)
					illegal = 1;
			}

			var disallow_these_file_extensions = "$PREF{disallow_these_file_extensions}";
			if(disallow_these_file_extensions)
			{
				var extension_is_in_disallowed_list = 0;
				var disallowed_extensions = disallow_these_file_extensions.split(" ");
				for(j = 0; j < disallowed_extensions.length; j++)
				{
					if(this_files_extension.toLowerCase() == disallowed_extensions[j].toLowerCase())
						extension_is_in_disallowed_list = 1;
				}

				if(extension_is_in_disallowed_list)
					illegal = 1;
			}

			var disallow_these_strings_within_filenames = "$PREF{disallow_these_strings_within_filenames___for_js}";
			if(disallow_these_strings_within_filenames)
			{
				var name_contains_disallowed_string = 0;
				var disallowed_strings = disallow_these_strings_within_filenames.split(" ");
				for(j = 0; j < disallowed_strings.length; j++)
				{
					var re = new RegExp(disallowed_strings[j], "i");
					if(filename.match(re))
						name_contains_disallowed_string = 1;
				}

				if(name_contains_disallowed_string)
					illegal = 1;
			}

			if(("$PREF{allow_files_without_extensions}" == "no")   &&   !this_files_extension)
			{
				illegal = 1;
			}

			if(!filename.match(/[0-9A-Za-z]/))
				illegal = 1;

			if(illegal)
			{
				var message = "$TEXT{illegal_filename_message}";
				message = message.replace(/%%filename%%/, filename);
				alert(message);
				return false;
			}
		}
	}
	return true;
}

function format_filesize_with_unit(num,space,forceMB,forceKB)
{
	if(!isNum(num,1)) { return "?" + space + "$PREF{KB}"; }

	var unit;
	if(   ((num > 999999)  ||  forceMB)   &&   !forceKB)
	{
		num = num/(1024*1024);
		num = num.toString();

		var testnum = num.replace( /^(\\d+\\.\\d).*/, '\$1' ); // show 1 decimal place. // extra escaping b/c printing JS from Perl.

		if(testnum == '0.0')
		{
			testnum = num.replace( /^(\\d+\\.\\d\\d).*/, '\$1' ); // show 2 decimal places.
		}
		if(testnum == '0.00')
		{
			testnum = num.replace( /^(\\d+\\.\\d\\d\\d).*/, '\$1' ); // show 3 decimal places.
		}
		num = testnum;

		unit = '$PREF{MB}';
	}
	else
	{
		num = parseInt(num/(1024));
		unit = '$PREF{KB}';
	}
	return num + space + unit;
}

function format_timespan_with_unit(num,space)
{
	if(!isNum(num)) { return "00:00:00"; }

	if(num >= (60*60))
	{
		var secs_left = num % (60*60);
		var mins_left = secs_left / 60;
		mins_left = mins_left.toString();
		mins_left = mins_left.replace( /^(\\d+)\\..*/, '\$1' ); // show no decimal places.  // extra escaping b/c printing JS from Perl.
		mins_left = mins_left.replace( /^(\\d)\$/, '0\$1' ); // for single-digits, prepend a zero.

		num = num/(60*60);
		num = num.toString();
		num = num.replace( /^(\\d+)\\..*/, '\$1' ); // show no decimal places.

		num = num + ':' + mins_left + ':00';
	}
	else if(num >= 60)
	{
		var secs_left = num % 60;
		secs_left = secs_left.toString().replace( /^(\\d)\$/, '0\$1' ); // for single-digits, prepend a zero.

		num = num/60;
		num = num.toString();
		num = num.replace( /^(\\d+)\\..*/, '\$1' ); // show no decimal places.  // extra escaping b/c printing JS from Perl.
		num = num.replace( /^(\\d)\$/, '0\$1' ); // for single-digits, prepend a zero.

		num = '00:' + num + ':' + secs_left;
	}
	else
	{
		num = num.toString();
		num = num.replace( /^(\\d+)\\..*/, '\$1' ); // show no decimal places. // extra escaping b/c printing JS from Perl.
		num = num.replace( /^(\\d)\$/, '0\$1' ); // for single-digits, prepend a zero.
		num = '00:00:' + num;
	}
	return num;
}

function isNum(testval,decimalsOK)
{
	if(typeof(testval) == 'undefined') return false;
	testval = testval.toString();
	if (!testval.length) return false;
	var numbers = decimalsOK ? '.0123456789' : '0123456789';
	for (i=0; i<testval.length; i++)
	{
		if (numbers.indexOf(testval.charAt(i),0) == -1) return false;
	}
	return true;
}

// In case the user set the form to N files, but then didn't populate all of them.
function update_numitems()
{
	var theform = document.getElementById('theuploadform');
	var inputs = theform.getElementsByTagName('input');
	var populated_file_elements = 0;
	chosen_filenames = [];
	var i = 0;
	for(i = 0; i < inputs.length; i++)
	{
		//if(inputs[i].type == 'file' || inputs[i].className.indexOf('reprocessingfile') != -1)
		if((inputs[i].type == 'file' || inputs[i].className.indexOf('reprocessingfile') != -1)   &&   inputs[i].value != ''   &&   inputs[i].value != undefined)
		{
			//populated_file_elements++;
			// Update 20101116 for multiple-files-within-a-single-input:
			var count = inputs[i].files ? inputs[i].files.length : 1; // older browsers (e.g. IE8) don't support the multi-files-in-one feature.
			populated_file_elements += count;

			if(inputs[i].files)
				for(j=0; j<inputs[i].files.length; j++)
					chosen_filenames.push(inputs[i].files[j].name);
			else
				chosen_filenames.push(inputs[i].value);
		}
	}

	// remove the path, which some browsers (IE8) include:
	for(j=0; j<chosen_filenames.length; j++)
		chosen_filenames[j] = chosen_filenames[j].replace(/.+[\\/\\\\]/, '');

	document.getElementById('numitems').value = populated_file_elements;

	if(document.getElementById('totalf'))
		document.getElementById('totalf').innerHTML = populated_file_elements;
	if(document.getElementById('leftf'))
		document.getElementById('leftf').innerHTML = populated_file_elements;

	if(theform.action.match( /items=\\d+/ ))
		theform.action = theform.action.toString().replace( /items=\\d+/, 'items=' + populated_file_elements );
	else
		theform.action += '&items=' + populated_file_elements;
}

function set_cookie(name, value, hours_to_live, path, domain, secure)
{
	var expireDate = "";
	if(hours_to_live)
	{
		expireDate = (new Date((new Date()).getTime() + hours_to_live*3600000)).toGMTString();
	}

	var curCookie = name + "=" + escape(value) +
	((hours_to_live) ? "; expires=" + expireDate : "") +
	((path) ? "; path=" + path : "") +
	((domain) ? "; domain=" + domain : "") +
	("$PREF{cookie_domain}" ? "; domain=$PREF{cookie_domain}" : "") +
	((secure) ? "; secure" : "");

	document.cookie = curCookie;
}


function get_cookie(name)
{
	var dc = document.cookie;
	var prefix = name + "=";
	var begin = dc.indexOf("; " + prefix);
	if (begin == -1) {
		begin = dc.indexOf(prefix);
		if (begin != 0) return null;
	} else
		begin += 2;
	var end = document.cookie.indexOf(";", begin);
	if (end == -1)
		end = dc.length;
	return unescape(dc.substring(begin + prefix.length, end));
}


function delete_cookie(name, path, domain)
{
	if(get_cookie(name))
	{
		document.cookie = name + "=" + 
		((path) ? "; path=" + path : "") +
		((domain) ? "; domain=" + domain : "") +
		"; expires=Thu, 01-Jan-70 00:00:01 GMT";
	}
	else
	{
		alert('$PREF{no_selections_text}');
	}
}


function gebi(id) { return document.getElementById(id); }


function enc_confirm(msg, yescallback, nocallback, yestext, notext)
{
	var div = document.createElement("div");
	div.className = "encpopup";
	div.id = "encpopup";

	div.innerHTML = '<div class="encpopup_inner">' + 
		msg +
		'<div class="encpopup_buttons">' +
		'<input id="enc_confirm_yesbtn" type="button" value="' + yestext + '" /> ' +
		'<input id="enc_confirm_nobtn" type="button" value="' + notext +  '" />' +
		'</div></div>';

	document.body.appendChild(div);

	if(gebi("enc_confirm_yesbtn").addEventListener)
	{
		// like using an inline onclick, except more correct, and inline onclick doesn't work in this case anyway.
		gebi("enc_confirm_yesbtn").addEventListener("click", function(){enc_confirm_return(yescallback);}, false);
		gebi("enc_confirm_nobtn").addEventListener("click", function(){enc_confirm_return(nocallback);}, false);
	}
	else if(gebi("enc_confirm_yesbtn").attachEvent) // for older versions of IE.
	{
		gebi("enc_confirm_yesbtn").attachEvent("onclick", function(){enc_confirm_return(yescallback);});
		gebi("enc_confirm_nobtn").attachEvent("onclick", function(){enc_confirm_return(nocallback);});
	}
}


function enc_confirm_return(callback)
{
	document.body.removeChild(gebi("encpopup"));
	callback();
}


function toggle_file_counts()
{
	var incl = document.getElementById("counts-incl-subfolders");
	var excl = document.getElementById("counts-excl-subfolders");

	if(excl)
	{
		if(excl.style.display == 'none')	{ incl.style.display = 'none'; excl.style.display = 'inline'; }
		else					{ excl.style.display = 'none'; incl.style.display = 'inline'; }
	}
}


function select_item(newvalue)
{
	var set_it = 1;
	var oldvalue = get_cookie('$PREF{selection_cookie_name}');
	if(oldvalue)
	{
		if(oldvalue.indexOf(newvalue) != -1)
		{
			if(window.confirm('$PREF{duplicate_item_text}'))
			{
				set_it = 1;
			}
			else
			{
				set_it = 0;
			}
		}

		newvalue = oldvalue + ':|:|:' + newvalue;
	}
	if(set_it)
	{
		set_cookie('$PREF{selection_cookie_name}', newvalue, 168, '/');
		alert('$PREF{item_added_to_cart_text}');
	}
}


function clear_selections()
{
	if(get_cookie('$PREF{selection_cookie_name}'))
	{
		if(window.confirm('$PREF{clear_selections_verification_text}'))
		{
			delete_cookie('$PREF{selection_cookie_name}', '/');
			location.reload();
		}
	}
	else
	{
		alert('$PREF{no_selections_text}');
	}
}


function select_all_items(newvalue)
{
	var checkboxes = document.getElementById("itemactions").getElementsByTagName("input");
	for(i = 0; i < checkboxes.length; i++)
	{
		if(checkboxes[i].type == 'checkbox' && checkboxes[i].className.indexOf('itemaction') != -1)
		{
			checkboxes[i].checked = newvalue;
			checkboxes[i].onchange();
		}
	}
}


function showhide_copymovedest_selector()
{
	var chosen = document.getElementById('actiontodo').value;
	var target = document.getElementById('copymovedest_wrapper');
	if(chosen == "copy_items"   ||   chosen == "move_items")
		target.style.display = 'block';
	else
		target.style.display = 'none';
}


function replace_items()
{
	var checkboxes = document.getElementById("itemactions").getElementsByTagName("input");
	var qsitems = '';
	var dirs_selected = 0;
	var j = 1;
	for(i = 0; i < checkboxes.length; i++)
	{
		if(checkboxes[i].checked)
		{
			if(checkboxes[i].name.match(/^dir-/))
			{
				dirs_selected = 1;
			}
			else
			{
				qsitems = qsitems + "rfn" + j + "=" + checkboxes[i].name + "&";
				j++;
			}
		}
	}

	if(j == 1)
	{
		alert("No files selected.");
	}
	else
	{
		if(dirs_selected)
		{
			alert("This operation only applies to files, so any folders that you have selected will be ignored.");
		}

		var qs = location.search;
		qs = qs.replace(/^\\?/, '');
		qs = qs.replace(/action=\\w+/, '');
		qs = qs.replace(/&+/g, '&');
		qs = qs.replace(/(^&|&\$)/, '');
		if(qs != '')
		{
			qs = qs + '&';
		}

		location.href = "$PREF{here_uploader_qsready}action=upload&" + qs + qsitems;
	}
}


function reprocess_items()
{
	var checkboxes = document.getElementById("itemactions").getElementsByTagName("input");
	var qsitems = '';
	var dirs_selected = 0;
	var j = 1;
	for(i = 0; i < checkboxes.length; i++)
	{
		if(checkboxes[i].checked)
		{
			if(checkboxes[i].name.match(/^dir-/))
			{
				dirs_selected = 1;
			}
			else
			{
				qsitems = qsitems + "ffs" + j + "=" + checkboxes[i].name + "&";
				j++;
			}
		}
	}

	if(j == 1)
	{
		alert("No files selected.");
	}
	else
	{
		if(dirs_selected)
		{
			alert("This operation only applies to files, so any folders that you have selected will be ignored.");
		}

		var qs = location.search;
		qs = qs.replace(/^\\?/, '');
		qs = qs.replace(/action=\\w+/, '');
		qs = qs.replace(/&+/g, '&');
		qs = qs.replace(/(^&|&\$)/, '');
		if(qs != '')
		{
			qs = qs + '&';
		}

		location.href = "$PREF{here_uploader_qsready}action=upload&" + qs + qsitems;
	}
}

function findPos(obj)
{
	var curleft = curtop = 0;
	if (obj.offsetParent)
	{
		curleft = obj.offsetLeft
		curtop = obj.offsetTop
		while (obj = obj.offsetParent)
		{
			curleft += obj.offsetLeft
			curtop += obj.offsetTop
		}
	}
	return [curleft,curtop];
}

var old_document_body_onclick = '';
function showoptsmenu(el)
{
	if(document.getElementById("theoptsmenu"))
	{
		return;
	}

	var div = document.createElement("div");
	div.className = "optsmenu";
	div.id = "theoptsmenu";
	div.style.position = 'absolute';
	var pos = findPos(el);
	div.style.left = eval(pos[0] + 30) + 'px';
	div.style.top = eval(pos[1] + 15) + 'px';
	document.body.appendChild(div);

	var size = '';
	var date = '';

	var row = el.parentNode.parentNode;
	var cols = row.childNodes;
	var i = 0;
	for(i = 0; i < cols.length; i++)
	{
		var children = cols[i].childNodes;
		var j = 0;
		for(j = 0; j < children.length; j++)
		{
			var link = children[j];
			if(link.nodeName == 'a' || link.nodeName == 'A')
			{
				if(cols[i].className == 'del')
				{
					var old_onclick = link.title;
					div.innerHTML += '<a href="#" onclick="closeoptsmenu(); ' + old_onclick + '">$TEXT{Delete}</a>';
				}
				else if(cols[i].className == 'sel')
				{
					var old_onclick = link.title;
					div.innerHTML += '<a href="#" onclick="closeoptsmenu(); ' + old_onclick + '">$PREF{select_item_link}</a>';
				}
				else if(cols[i].className == 'cp')
				{
					div.innerHTML += '<a href="' + link.href + '">$TEXT{Copy}</a>';
				}
				else if(cols[i].className == 'mv')
				{
					div.innerHTML += '<a href="' + link.href + '">$TEXT{Move_Rename}</a>';
				}
				else if(cols[i].className == 'info')
				{
					div.innerHTML += '<a href="' + link.href + '">$TEXT{Info}</a>';
				}
				else if(cols[i].className == 'mopts')
				{
					div.innerHTML += '<a href="' + link.href + '">' + link.innerHTML + '</a>';
				}
				else if(cols[i].className == 'perms')
				{
					div.innerHTML += '<a href="' + link.href + '">$TEXT{Permissions}</a>';
				}
				else if(cols[i].className == 'addbuy')
				{
					div.innerHTML += '<a href="' + link.href + '">' + link.innerHTML + '</a>';
				}
			}
			else
			{
				if(cols[i].className == 'size')
				{
					size = ` . ($PREF{show_size_column_in_filelist} =~ /no/i ? qq`'<div class="text">$TEXT{Size}: ' + children[j].nodeValue + '</div>'` : qq`''`) . qq`;
				}
				else if(cols[i].className == 'date')
				{
					date = ` . ($PREF{show_date_column_in_filelist} =~ /no/i ? qq`'<div class="text">$TEXT{Date}: ' + children[j].nodeValue + '</div>'` : qq`''`) . qq`;
				}
			}
		}
	}

	div.innerHTML += size + date;

	if(!div.innerHTML)
	{
		div.innerHTML += '<a href="#" onclick="return false;">$TEXT{_none_}</a>';
	}


	//div.innerHTML += "<a href=\\"#\\" onclick=\\"closeoptsmenu(); return false\\">$TEXT{_Close_Menu_}</a>";
	window.setTimeout("set_body_closeoptsmenu()", 500);
}

function set_body_closeoptsmenu()
{
	old_document_body_onclick = document.body.onclick;
	document.body.onclick = closeoptsmenu;
}

function closeoptsmenu()
{
	if(document.getElementById("theoptsmenu"))
	{
		document.body.removeChild(document.getElementById("theoptsmenu"));
		document.body.onclick = old_document_body_onclick;
		return true;
	}
}

function set_itemaction_highlights()
{
	var list = document.getElementById("filelist") ? document.getElementById("filelist") : document.getElementById("filegrid")
	if(list)
	{
		var filelist_inputs = list.getElementsByTagName("input");
		var i = 0;
		for(i = 0; i < filelist_inputs.length; i++)
		{
			if(filelist_inputs[i].className.indexOf('itemaction') != -1)
			{
				filelist_inputs[i].onchange = setbghighlight;
				filelist_inputs[i].onclick = setbghighlight; // IE is garbage.
			}
		}
	}
}

function setbghighlight()
{
	var p = this.parentNode.parentNode;
	if(this.checked)
	{
		p.style.background = '$PREF{filelist_row_highlight_bgcolor}';
		p.onmouseover = '';
		p.onmouseout = '';
	}
	else
	{
		if(document.getElementById("filelist"))
		{
			p.onmouseover = setbg;
			unsettext(p);
			if(p.className.indexOf('odd') != -1)
			{
				p.style.background = '$PREF{filelist_row_normal_bgcolor_odd}';
				p.onmouseout = unsetbgodd;
			}
			else
			{
				p.style.background = '$PREF{filelist_row_normal_bgcolor_even}';
				p.onmouseout = unsetbgeven;
			}
		}
		else // filegrid.
		{
			p.style.background = '';
		}
	}
}

function set_row_mouseovers()
{
	if(document.getElementById("filelist"))
	{
		var filelist_rows = document.getElementById("filelist").getElementsByTagName("tr");
		for(i = 0; i < filelist_rows.length; i++)
		{
			var r = filelist_rows[i];

			     if(r.className.indexOf('even') != -1)	{ r.onmouseover = setbg; r.onmouseout  = unsetbgeven;	}
			else if(r.className.indexOf('odd') != -1)	{ r.onmouseover = setbg; r.onmouseout  = unsetbgodd;	}
		}
	}
}

function setbg()
{
	this.style.background = '$PREF{filelist_row_hover_bgcolor}';

` . (high_contrast_style_enabled() ? qq`
	var tds = this.getElementsByTagName("td");
	var i = 0;
	for(i = 0; i < tds.length; i++)
	{
		tds[i].style.color = '$PREF{filelist_row_hover_text_color}';
		if(tds[i].getElementsByTagName("a"))
		{
			var links = tds[i].getElementsByTagName("a");
			var j = 0;
			for(j = 0; j < links.length; j++)
			{
				links[j].style.color = '$PREF{filelist_row_hover_link_color}';
			}
		}
	}
` : '') . qq`
}

function unsetbgeven()
{
	this.style.background = '$PREF{filelist_row_normal_bgcolor_even}';
	` . (high_contrast_style_enabled() ? qq`unsettext(this);` : '') . qq`
}

function unsetbgodd()
{
	this.style.background = '$PREF{filelist_row_normal_bgcolor_odd}';
	` . (high_contrast_style_enabled() ? qq`unsettext(this);` : '') . qq`
}

function unsettext(myself)
{
	var tds = myself.getElementsByTagName("td");
	var i = 0;
	for(i = 0; i < tds.length; i++)
	{
		tds[i].style.color = '$PREF{filelist_row_normal_text_color}';
		if(tds[i].getElementsByTagName("a"))
		{
			var links = tds[i].getElementsByTagName("a");
			var j = 0;
			for(j = 0; j < links.length; j++)
			{
				links[j].style.color = '$PREF{filelist_row_normal_link_color}';
			}
		}
	}
}

function set_up_human_test()
{
	var htimg = document.getElementById("fcht0");
	var htfield1 = document.getElementById("fcht1");
	var htfield2 = document.getElementById("fcht2");
	var fcht3 = document.getElementById("fcht3");
	var fcht4 = document.getElementById("fcht4");
	if(htfield1 && htfield2)
	{
		htimg.src = htimg.src.replace(/\\w+\\.jpg/, fcht3.value+'.jpg');

		htfield1.value = fcht3.value;

		if(document.getElementById("ht_is_invisible"))
			htfield2.value = fcht4.value;
	}
}

var uploadbutton_text_default = '';

function check_humanity()
{
	num_upload_checks_still_pending++;

	uploadbutton_text_default = document.getElementById("$PREF{uploadbutton_id}").value;
	document.getElementById("$PREF{uploadbutton_id}").value = "$TEXT{Please_wait}";
	document.getElementById("$PREF{uploadbutton_id}").disabled = true;

	var url_to_get = '$ENV{SCRIPT_NAME}?ajax_do_humantest&fcht1=' + document.getElementById("fcht1").value + '&fcht2=' + document.getElementById("fcht2").value;
	do_ajax_request(url_to_get, check_humanity__finish);
}

function check_humanity__finish(output_from_request)
{
	num_upload_checks_still_pending--;

	document.getElementById("$PREF{uploadbutton_id}").value = uploadbutton_text_default;
	document.getElementById("$PREF{uploadbutton_id}").disabled = false;

	if(output_from_request.match(/passed=true/))
		do_upload();
	else
		alert("$TEXT{Error__failed_human_test__please_try_again_}");
}

function kill_keepalive_to_work_around_safari_bug()
{
	// https://bugs.webkit.org/show_bug.cgi?id=5760

	num_upload_checks_still_pending++;

	uploadbutton_text_default = document.getElementById("$PREF{uploadbutton_id}").value;
	document.getElementById("$PREF{uploadbutton_id}").value = "$TEXT{Please_wait}";
	document.getElementById("$PREF{uploadbutton_id}").disabled = true;
	
	var url_to_get = '$ENV{SCRIPT_NAME}?action=killkeepalive';
	do_ajax_request(url_to_get, kill_keepalive_to_work_around_safari_bug__finish);
}

function kill_keepalive_to_work_around_safari_bug__finish(output_from_request)
{
	num_upload_checks_still_pending--;

	document.getElementById("$PREF{uploadbutton_id}").value = uploadbutton_text_default;
	document.getElementById("$PREF{uploadbutton_id}").disabled = false;

	do_upload();
}

function do_ajax_request(url_to_get, callback_function)
{
	var ajax_request = create_ajax_object();
	if(ajax_request)
	{
		ajax_request.onreadystatechange = function()
		{
			if(ajax_request)
			{
				if(ajax_request.readyState == 4)
				{
					if(ajax_request.status == 200)
					{
						var rawdata = ajax_request.responseText.match(/<data>(.+)<\\/data>/);
						callback_function(rawdata ? rawdata[1] : "");
					}
				}
			}
		}
		ajax_request.open('GET', url_to_get, true);
		ajax_request.send(null);
	}
}

function add_file_element_if_necessary()
{
	var i=1;
	var empty_one_exists = 0;
	while(document.getElementById("$PREF{filefield_namebase}"+i))
	{
		if(!document.getElementById("$PREF{filefield_namebase}"+i).value)
			empty_one_exists=1;
		i++;
	}
	if(!empty_one_exists   &&   (document.getElementById("numfileelements").value < $PREF{max_files_allowed}))
		add_file_element();
}

function add_file_element()
{
	var firstfile_div = document.getElementById("firstfile");
	var newfile_div = firstfile_div.cloneNode(true);

	var newnum = document.getElementById("numfileelements").value;
	newnum++;

	if(newnum > $PREF{max_files_allowed})
	{
		alert("$TEXT{The_owner_of_this_site_has_set_the_limit_to} $PREF{max_files_allowed}.");
		return;
	}

	newfile_div.id = 'nthfile_' + newnum;

	var i = 0;
	var kids = new Array();

	// Note: add input elements first (input, select, textarea), then
	// add their containers (divs, etc) and any other elements.

	var new_inputs = newfile_div.getElementsByTagName("input");
	for(i = 0; i < new_inputs.length; i++)
		kids.push(new_inputs[i]);

	var new_selects = newfile_div.getElementsByTagName("select");
	for(i = 0; i < new_selects.length; i++)
		kids.push(new_selects[i]);

	var new_textareas = newfile_div.getElementsByTagName("textarea");
	for(i = 0; i < new_textareas.length; i++)
		kids.push(new_textareas[i]);

	var new_labels = newfile_div.getElementsByTagName("label");
	for(i = 0; i < new_labels.length; i++)
		kids.push(new_labels[i]);

	var new_divs = newfile_div.getElementsByTagName("div");
	for(i = 0; i < new_divs.length; i++)
		kids.push(new_divs[i]);

	var new_spans = newfile_div.getElementsByTagName("span");
	for(i = 0; i < new_spans.length; i++)
		kids.push(new_spans[i]);

	for(i = 0; i < kids.length; i++)
	{
		// First we'll increment uploadname1, subdir1, and newsubdir1; then we'll
		// remove any divs (possibly including those incremented inputs) that 
		// should not be present on elements other than the 1st one.

		var done = 0;
		if(kids[i].name == '$PREF{filefield_namebase}1')
		{
			// This is the actual file input field.
			kids[i].id = '$PREF{filefield_namebase}' + newnum;
			kids[i].name = '$PREF{filefield_namebase}' + newnum;
			kids[i].value = '';
			kids[i].className = kids[i].className.replace(/required/, '');
			unmark_input_error(kids[i], 'input_error_reqd');
			done = 1;

			// Only required for Opera; this clears the value of the file input:
			if(navigator.userAgent.indexOf("Opera") != -1)
			{
				var wrapper = document.createElement("span");
				wrapper.appendChild(kids[i].cloneNode(false));
				wrapper.innerHTML = wrapper.innerHTML;
				var newElement = wrapper.firstChild.cloneNode(false);
				kids[i].parentNode.replaceChild(newElement,kids[i]);
			}
		}
		if(kids[i].name == 'subdir1')
		{
			kids[i].name = 'subdir' + newnum;
			done = 1;
		}
		if(kids[i].name == 'newsubdir1')
		{
			kids[i].name = 'newsubdir' + newnum;
			kids[i].value = '';
			done = 1;
		}
		if(kids[i].className.indexOf('picksubdir') != -1)
		{
			if(document.getElementById("only_one_subdir_dropdown"))
				if(kids[i].parentNode)
					kids[i].parentNode.removeChild(kids[i]);
			done = 1;
		}
		if(kids[i].className.indexOf('newsubdir') != -1)
		{
			if(document.getElementById("only_one_new_subdir"))
				if(kids[i].parentNode)
					kids[i].parentNode.removeChild(kids[i]);
			done = 1;
		}
		if(kids[i].className.indexOf('note_newsubdir') != -1)
		{
			if(document.getElementById("only_one_new_subdir"))
				if(kids[i].parentNode)
					kids[i].parentNode.removeChild(kids[i]);
			done = 1;
		}
		if(kids[i].className == 'filei')
		{
			kids[i].innerHTML = newnum;
			done = 1;
		}
		if(kids[i].className.indexOf('incmyid') != -1)
		{
			kids[i].id = kids[i].id.replace(/\\d\$/, newnum);
			done = 1;
		}
		if(kids[i].className.indexOf('nullmyinnerhtml') != -1)
		{
			kids[i].innerHTML = '';
			done = 1;
		}

		if(!done) // anything left is a perfile formfield.
		{
			if(kids[i].name && kids[i].name.match(/\\w+1\$/))
			{
				kids[i].name = kids[i].name.replace(/1\$/, newnum);
				kids[i].value = '';
			}
			if(kids[i].id && kids[i].id.match(/\\w+1\$/))
			{
				kids[i].id = kids[i].id.replace(/1\$/, newnum);
			}
			if(kids[i].htmlFor && kids[i].htmlFor.match(/\\w+1\$/))
			{
				kids[i].htmlFor = kids[i].htmlFor.replace(/1\$/, newnum);
			}
		}
	}

	if((newnum % 2)==0)
		newfile_div.className = newfile_div.className.replace(/odd/, 'even');

	newfile_div.className = newfile_div.className.replace(/first/, ''); // the new one isn't first...
	firstfile_div.className = firstfile_div.className.replace(/last/, ''); // ...and now the first one isn't last anymore.

	document.getElementById("numfileelements").value = newnum;
	document.getElementById("numitems").value = newnum;

	if("$TEXT{upload_form_subdir_note_4}" != "")
	{
		var note = document.createElement("div");
		note.className = 'upform_note';
		note.innerHTML = "$TEXT{upload_form_subdir_note_4}";
		newfile_div.appendChild(note);
	}

	if(document.getElementById("subdir_dropdown_visible") || document.getElementById("new_subdir_field_visible"))
	{
		var subdirnote = document.createElement("div");
		subdirnote.className = 'upform_note';
		if(document.getElementById("only_one_subdir_dropdown") && document.getElementById("only_one_new_subdir"))
			subdirnote.innerHTML = "$TEXT{upload_form_subdir_note_1}";
		else if(document.getElementById("only_one_subdir_dropdown"))
			subdirnote.innerHTML = "$TEXT{upload_form_subdir_note_2}";
		else if(document.getElementById("only_one_new_subdir"))
			subdirnote.innerHTML = "$TEXT{upload_form_subdir_note_3}";

		if(subdirnote.innerHTML)
			newfile_div.appendChild(subdirnote);
	}

	// Add a link to remove the new element, in case the user doesn't want the extra file:
	add_removal_link_for_extra_file_field(newnum, newfile_div);

	if(gebi("perfile-textboxes"))
		add_autofill_link_for_extra_file_field(newnum, newfile_div);

	// Remove any previous removal link, so that only the final file can be removed:
	var previous_removal_link = document.getElementById('nthfile_removal_link_' + (newnum - 1));
	if(previous_removal_link)
		previous_removal_link.parentNode.removeChild(previous_removal_link);

	firstfile_div.parentNode.appendChild(newfile_div);

	update_file_count(newnum);
}

function remove_file_element(elnum)
{
	theel = document.getElementById('nthfile_' + elnum);
	var newnum = elnum - 1;
	if(theel)
	{
		theel.parentNode.removeChild(theel);
		update_file_count(newnum);
		if(newnum != 1)
			add_removal_link_for_extra_file_field(newnum, document.getElementById('nthfile_' + newnum))
	}
}

function add_removal_link_for_extra_file_field(newnum, afile_div)
{
	var removal_link = document.createElement("div");
	removal_link.id = 'nthfile_removal_link_' + newnum;
	removal_link.className = 'nthfile_removal_link';
	removal_link.innerHTML = '<a href="#" onclick="remove_file_element(' + newnum + ');return false">$TEXT{extra_file_field_removal_link}</a>';
	if("$TEXT{extra_file_field_removal_link}" != "")
		afile_div.appendChild(removal_link);
}

function add_autofill_link_for_extra_file_field(newnum, afile_div)
{
	var autofill_link = document.createElement("div");
	autofill_link.id = 'nthfile_autofill_link_' + newnum;
	autofill_link.className = 'nthfile_autofill_link';
	autofill_link.innerHTML = '<a href="#" onclick="autofill_perfile_form_fields(' + newnum + ');return false">$TEXT{extra_file_field_autofill_link}</a>';
	if("$TEXT{extra_file_field_autofill_link}" != "")
		afile_div.appendChild(autofill_link);
}

function autofill_perfile_form_fields(filenum)
{
	var fields = document.getElementById("filefields");
	if(fields.getElementsByClassName)
	{
		var perfile_inputs = fields.getElementsByClassName('upform_field');
		for(var i=0; i<perfile_inputs.length; i++)
		{
			var re = new RegExp('_' + filenum + '\$');
			if(perfile_inputs[i].id.match(re))
			{
				id_for_this_field_on_the_first_file = perfile_inputs[i].id.replace(/_\\d+\$/, '_1');
				id_for_this_field_on_the_previous_file = perfile_inputs[i].id.replace(/_\\d+\$/, '_' + (filenum - 1));
				perfile_inputs[i].value = gebi(id_for_this_field_on_the_first_file).value;
			}
		}
	}
	else
	{
		alert("Your browser does not support this feature.");
	}

}

function update_file_count(newnum)
{
	document.getElementById("numfileelements").value = newnum;
	document.getElementById("numitems").value = newnum;
	var spans = document.getElementById("filefields").getElementsByTagName("span");
	for(i = 0; i < spans.length; i++)
	{
		if(spans[i].className == 'fileitotal')
			spans[i].innerHTML = newnum;
	}
}

var mouseX = 0;
var mouseY = 0;

function getMousePosition(event)
{
	var mouseX = window.event ? window.event.clientX : event.pageX;
	var mouseY = window.event ? window.event.clientY : event.pageY;
	//document.getElementById("title").innerHTML = mouseX + ' ' + mouseY;
}

function mouse_coords_init()
{
	document.onmousemove = getMousePosition;
}

function get_random_text()
{
	var now = new Date();
	var time = (now.getTime() - now.getMilliseconds()) / 1000;
	var ms = now.getMilliseconds();

	var ua = navigator.userAgent;
	var sw = screen.width;
	var sh = screen.height;
	var rand = Math.random();

	var mime = navigator.mimeTypes;
	var mimestring = '';
	for(var i=0; i<mime.length; i++)
	{
		mimestring += mime[i].type + mime[i].description;
	}

	var unique = 'time:' + time + ', ms:' + ms + ', rand:' + rand + ', sw:' + sw + ', sh:' + sh + ', ua:' + ua + ', mouseX:' + mouseX + ', mouseY:' + mouseY;
	//unique += mimestring;
	return unique;
}

function start_juststatus()
{
	if(document.getElementById("fcjuststatus"))
	{
		var timeout = navigator.userAgent.indexOf("Safari") == -1 ? 1200 : 1200;
		schedule_progressbar_update(timeout);
	}
}


function verify_that_new_passwords_match()
{
	var pw1 = '';
	var pw2 = '';

	var inputs = document.getElementsByTagName("input");
	for(var i = 0; i < inputs.length; i++)
	{
		if(inputs[i].className.indexOf('encnewpw') != -1)
		{
			if(pw1)
				pw2 = inputs[i].value;
			else
				pw1 = inputs[i].value;
		}
	}

	if(pw1 != pw2)
	{
		alert("$TEXT{Passwords_do_not_match_}");
		return false;
	}
	else
	{
		return true;
	}
}

function undisable_upload_button()
{
	// necessary so if a user browses back to the upload page,
	// they can actually click the upload button, which we had
	// disabled during the previous upload.
	var btn = document.getElementById('$PREF{uploadbutton_id}');
	if(btn)
		btn.disabled = false;
}

function run_download_timer()
{
	var timer = document.getElementById('fcdownloaddelaytimer');
	if(timer)
	{
		var value = timer.innerHTML;
		value--;
		timer.innerHTML = value;
		if(value < 1)
			document.getElementById('fcdownloadlinkdelayed').style.display = 'block';
		else
			window.setTimeout("run_download_timer()", 1000);
	}
}

function show_datepicker(el_id)
{
	return; // in development.

	var theel = gebi(el_id);

	var picker = document.createElement("div");
	picker.className = 'encdatepicker';
	picker.style.position = 'absolute';
	var pos = findPos(theel);
	picker.style.left = eval(pos[0] + 0) + 'px';
	picker.style.top = eval(pos[1] + 25) + 'px';



	var today = new Date();
	var first_of_the_month = new Date(today.getFullYear(), today.getMonth(), 1, 0, 0, 0, 0);
	var day_of_week_for_first_of_month = first_of_the_month.getDay();
	









	document.body.appendChild(picker);
}

//////////////////////////////////////////////////////////// Start SHA-1 code.
// SHA-1 code from: http://pajhome.org.uk/crypt/md5
//
// Configurable variables. You may need to tweak these to be compatible with
// the server-side, but the defaults work in most cases.
var hexcase = 0;  /* hex output format. 0 - lowercase; 1 - uppercase        */
var b64pad  = ""; /* base-64 pad character. "=" for strict RFC compliance   */
var chrsz   = 8;  /* bits per input character. 8 - ASCII; 16 - Unicode      */

function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}
function core_sha1(x, len)
{
  /* append padding */
  x[len >> 5] |= 0x80 << (24 - len % 32);
  x[((len + 64 >> 9) << 4) + 15] = len;

  var w = Array(80);
  var a =  1732584193;
  var b = -271733879;
  var c = -1732584194;
  var d =  271733878;
  var e = -1009589776;

  for(var i = 0; i < x.length; i += 16)
  {
    var olda = a;
    var oldb = b;
    var oldc = c;
    var oldd = d;
    var olde = e;

    for(var j = 0; j < 80; j++)
    {
      if(j < 16) w[j] = x[i + j];
      else w[j] = rol(w[j-3] ^ w[j-8] ^ w[j-14] ^ w[j-16], 1);
      var t = safe_add(safe_add(rol(a, 5), sha1_ft(j, b, c, d)),
                       safe_add(safe_add(e, w[j]), sha1_kt(j)));
      e = d;
      d = c;
      c = rol(b, 30);
      b = a;
      a = t;
    }

    a = safe_add(a, olda);
    b = safe_add(b, oldb);
    c = safe_add(c, oldc);
    d = safe_add(d, oldd);
    e = safe_add(e, olde);
  }
  return Array(a, b, c, d, e);

}
function sha1_ft(t, b, c, d)
{
  if(t < 20) return (b & c) | ((~b) & d);
  if(t < 40) return b ^ c ^ d;
  if(t < 60) return (b & c) | (b & d) | (c & d);
  return b ^ c ^ d;
}
function sha1_kt(t)
{
  return (t < 20) ?  1518500249 : (t < 40) ?  1859775393 :
         (t < 60) ? -1894007588 : -899497514;
}
function safe_add(x, y)
{
  var lsw = (x & 0xFFFF) + (y & 0xFFFF);
  var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
  return (msw << 16) | (lsw & 0xFFFF);
}
function rol(num, cnt)
{
  return (num << cnt) | (num >>> (32 - cnt));
}
function str2binb(str)
{
  var bin = Array();
  var mask = (1 << chrsz) - 1;
  for(var i = 0; i < str.length * chrsz; i += chrsz)
    bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask) << (32 - chrsz - i%32);
  return bin;
}
function binb2hex(binarray)
{
  var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
  var str = "";
  for(var i = 0; i < binarray.length * 4; i++)
  {
    str += hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8+4)) & 0xF) +
           hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8  )) & 0xF);
  }
  return str;
}
//////////////////////////////////////////////////////////// End SHA-1 code.


function schedule_onload_action(newfunc)
{
	var already_scheduled = window.onload;
	if(typeof window.onload != 'function')
	{
		window.onload = newfunc;
	}
	else
	{
		window.onload = function()
		{
			already_scheduled();
			newfunc();
		}
	}
}


function filechucker_init()
{
	mouse_coords_init();
	set_up_human_test();
	set_row_mouseovers();
	set_itemaction_highlights();
	generate_new_serial_number();
	reset_iframe_location();
	undisable_upload_button();
	start_juststatus();
	update_onload_status();
	run_download_timer();
}


if('$PREF{do_javascript_init_at_onload}' == 'yes')
	schedule_onload_action(filechucker_init);


document.write("<scr" + "ipt type='text/javascript' src='$PREF{app_base_folder}/js/js_table_sort.js'></scr" + "ipt>");
document.write("<scr" + "ipt type='text/javascript' src='$PREF{app_base_folder}/js/getElementsByClassName.js'></scr" + "ipt>");


$PREF{custom_js_code}

`;

return $js;
}


sub get_css
{
	my $num = shift; # optional, for situations where you want to make separate $PREF{css}, $PREF{css1}, $PREF{css2}, etc., settings.

	my $css = $PREF{"css${num}"} . "\n\n"
		. $PREF{"css${num}_shared"} . "\n\n"
		. $PREF{"css${num}_$PREF{current_app_style}"} . "\n\n"
		. $PREF{"css${num}_shared_$PREF{current_app_style}"} . "\n\n"
		. $PREF{"css${num}_extra"};

$css .= qq`

$PREF{"custom_css$num"}

</style>

<!--[if IE]>
<style type="text/css">
.actionrow .links, .actionrow .sizeinfo { margin-top: 4px; }
$PREF{"css${num}_$PREF{current_app_style}_ie"}
</style>
<![endif]-->

<!--[if lt IE 7]>
<style type="text/css">
$PREF{"css${num}_$PREF{current_app_style}_ie6"}
</style>
<![endif]-->

<style type="text/css">

$PREF{"custom_css$num"}

`;

	$css .= $PREF{using_upload_hook} =~ /yes/i ? $PREF{css_for_upload_progress_table___hook} : $PREF{css_for_upload_progress_table___nonhook};

	return $css;
}


sub determine_current_style()
{
	my $stylecookie = get_cookie("fcliststyle");
	my @enabled_styles = split /[,\s]+/, $PREF{enabled_styles};
	if($PREF{enable_app_style_switcher} =~ /yes/i)
	{
		foreach my $style (@enabled_styles)
		{
			my @other_styles = split /[,\s]+/, $PREF{enabled_styles};
			my %other_styles = ();
			foreach my $other_style (@other_styles)
			{
				$other_styles{$other_style} = 1 unless $other_style eq $style;
			}

			if(   ($stylecookie eq $style)   ||   ($PREF{default_app_style} eq $style   &&   !$other_styles{$stylecookie})   )
			{
				$PREF{current_app_style} = $style;
			}
		}
	}
	else
	{
		foreach my $style (@enabled_styles)
		{
			if($PREF{default_app_style} eq $style)
			{
				$PREF{current_app_style} = $style;
			}
		}
	}
}



sub high_contrast_style_enabled()
{
	return current_app_style_is_highcontrast();
}


sub current_app_style_is_highcontrast()
{
	#return (get_current_app_style() =~ /^(light)$/);

	my $currentstyle = get_current_app_style();
	if($PREF{"${currentstyle}___filelist_row_hover_bgcolor_highcontrast"} && $PREF{"${currentstyle}___filelist_row_hover_bgcolor_highcontrast"} =~ /\S/)
	{
		return 1;
	}
	else { return 0; }
}


sub get_current_app_style()
{
	if($PREF{enable_app_style_switcher} =~ /yes/i   &&   get_cookie("fcliststyle"))
	{
		return get_cookie("fcliststyle");
	}
	else
	{
		return $PREF{default_app_style};
	}
}


sub onedecimal
{
	my $num = shift;
	return $num =~ /^(\d+\.\d).*/ ? $1 : $num;
}


sub twodecimals
{
	my $num = shift;
	$num =~ s/(\.\d\d).*/$1/;

	if($num !~ /\./)
	{
		$num .= '.00';
	}
	elsif($num =~ /\.$/)
	{
		$num .= '00';
	}
	elsif($num =~ /\.\d$/)
	{
		$num .= '0';
	}

	return $num;
}


sub list_uploaded_files()
{
	unless(user_is_allowed_to('view_download_page')) { exit_with_access_denied('view_download_page'); }
	$PREF{on_page} = 'filelist';

	delete_old_files();

	my $output = '';
	start_html_output($PREF{subtitle___filelist});

	my $dateformat = $PREF{date_format_for_filelist} ? $PREF{date_format_for_filelist} : "%Y-%m-%d, %H:%M";

	my $userdir = get_userdir_for_qs();

	my (@items,@files,@dirs) = ();

	my $fulldir = $PREF{uploaded_files_realpath};
	my $path = '';
	if($PREF{enable_subdirs} =~ /yes/i   &&   $qs =~ /(?:^|&)path=(.*?)(?:&|$)/)
	{
		$path = $1;
		enc_urldecode($path);
		$path .= '/';
		$path = enc_untaint($path,'keep_path');

		$path = '' if ($PREF{enable_userdirs} =~ /yes/i   &&   this_is_the_userdir_folder($path)   &&   !(user_is_allowed_to('read_all_userdirs') || logged_in_user_is_subgroup_manager())); # view the root of the users folder.

		if($path =~ m!^[/\\]+$!)
		{
			$path = '';
		}
		else
		{
			$fulldir .= '/' . $path;
			exit_with_error("Error: the path you specified ($path) does not exist.") unless -d $fulldir;

			# Don't check for writability; for listing/downloading, it doesn't matter, so proceed even if it's not writable.
			#exit_with_error("Error: the path you specified ($path) is not writable.") unless -w $fulldir;
		}
	}

	if($PREF{userdir}   &&   !$path   &&   $PREF{navigate_users_into_userdirs_automatically} =~ /yes/i)
	{
		if(logged_in_user_is_subgroup_manager())
		{
			$path = "$PREF{userdir_folder_name}/"; 
		}
		else
		{
			$path = "$PREF{userdir_folder_name}/$PREF{userdir}/"; 
		}
		$fulldir .= '/' . $path;
	}

	my $hide_topmost_level = 0;
	if($PREF{userdir}   &&   $PREF{hide_links_to_topmost_level_from_userdir_users} =~ /yes/i   &&   !$PREF{admin_is_logged_in})
	{
		$hide_topmost_level = 1;
	}


	my $path_urlencoded = urlencode_path_but_leave_slashes($path);

	# Add a top-level link to the user's userdir (if enabled), which is technically not in the top level:
	#
	if($PREF{userdir}   &&   !$path)
	{
		# If userdirs are enabled, and this visitor has supplied one, and we're at the top level, 
		# then display a link to his userdir.  This has to be fudged a little since his userdir
		# is not actually in this folder, it's in a subfolder (namely the $PREF{userdir_folder_name}
		# subfolder).

		unless(logged_in_user_is_part_of_a_subgroup() && $PREF{hide_toplevel_userdir_shortcut_for_subgroup_owned_users} =~ /yes/i)
		{
			unshift @dirs, "::special:userdir_shortcut::$PREF{userdir_folder_name}/$PREF{userdir}";
		}
	}

	# Also create a shortcut link to the SGM's userdir in the top level, if that's enabled:
	#
	if(!$path   &&   (my $SGM_username = logged_in_user_is_part_of_a_subgroup()))
	{
		my $SGM_userdir_path = "$PREF{userdir_folder_name}/$SGM_username"; # TODO: userdir can now come from email, userid, etc, so this needs to be not hard-coded to username.
		unshift (@dirs, "::special:SGM_userdir_shortcut::$SGM_userdir_path") if is_userdir_folder_that_this_user_can_read($SGM_userdir_path);
	}

	# If userdirs are enabled, but this user is trying to access someone else's userdir, stop him:
	#
	if(is_a_userdir_folder($path) && !is_userdir_folder_that_this_user_can_read($path))
	{
		exit_with_error("Error: insufficient privileges for viewing this item (failed userdir access).");
	}

	if($path)
	{
		exit_with_error("Error: insufficient privileges for viewing this item (failed folder display).") unless folder_is_allowed_to_be_displayed("$path_urlencoded");
	}
	else
	{
		# Don't do this, because we want to be able to mark top-level dirs as public-RO or public-RW
		# and have them show up in the file-list even if a member is not logged in.
		#
		#exit_with_error("Error: insufficient privileges for viewing this item.") unless folder_is_allowed_to_be_displayed("/");

		exit_with_access_denied('view_download_page') unless user_is_allowed_to('view_top_level_of_download_page');
	}


	my $hidesize = $PREF{show_size_column_in_filelist} =~ /no/i ? ' style="display: none;"' : '';
	my $hidedate = $PREF{show_date_column_in_filelist} =~ /no/i ? ' style="display: none;"' : '';
	my $hidebuy  = !$PREF{show_buy_column_in_filelist} || ($PREF{show_buy_column_in_filelist} =~ /no/i) ? ' style="display: none;"' : '';


	my $qs_without_sort = $qs;
	$qs_without_sort =~ s/(?:^|&)s=(?:n|s|d)r?(?:&|$)//g;
	$qs_without_sort =~ s/&+$//g;
	$qs_without_sort =~ s/&/&amp;/g;
	my $sort_string_present = $qs =~ /(?:^|&)s=(?:n|s|d)r?(?:&|$)/ ? 1 : 0;
	my $column_headers =	  qq`\n<tr>`
				. qq`<th id="namehead"><a href="$PREF{here_filelist}?$qs_without_sort&amp;s=n` . (($qs =~ /(?:^|&)s=n(?:&|$)/ || !$sort_string_present) ? 'r' : '') . qq`">$TEXT{Name}</a></th>`
				. $PREF{custom_filelist_column_code__header}
				. qq`<th id="buyhead"$hidebuy><a href="$PREF{here_filelist}?$qs_without_sort&amp;s=d` . ($qs =~ /(?:^|&)s=d(?:&|$)/ ? 'r' : '') . qq`">$TEXT{Buy_column_header_for_filelist}</a></th>`
				. qq`<th id="sizehead"$hidesize><a href="$PREF{here_filelist}?$qs_without_sort&amp;s=s` . ($qs =~ /(?:^|&)s=s(?:&|$)/ ? 'r' : '') . qq`">$TEXT{Size}</a></th>`
				. qq`<th id="datehead"$hidedate><a href="$PREF{here_filelist}?$qs_without_sort&amp;s=d` . ($qs =~ /(?:^|&)s=d(?:&|$)/ ? 'r' : '') . qq`">$TEXT{Date}</a></th>`
				. (display_info_column() ? qq`<th id="infohead"></th>` : '')
				. qq`<th id="cphead"></th>`
				. qq`<th id="mvhead"></th>`
				. qq`<th id="delhead"></th>`
				. qq`<th id="opthead"></th>`
				. qq`<th id="selhead"></th>`
				. qq`<th id="moptshead"></th>`
				. (   custom_folder_perms_enabled()   ? qq`<th id="permshead"></th>` : '')
				. (display_item_action_checkboxes() ? qq`<th id="acthead"></th>` : '')
				. qq`<th id="spchead"></th>`
				. qq`</tr>`
				. qq`\n`;



	@items = get_sorted_filelist_items($fulldir);

	for(@items)
	{
		push (@dirs, $_) if ($PREF{enable_subdirs} =~ /yes/i   &&   -d "$fulldir/$_");
		push (@files, $_) if -f "$fulldir/$_";
	}


	my $viewing_title = qq`<h4>$TEXT{Uploaded_Files_}</h4>\n`;
	if($PREF{enable_subdirs} =~ /yes/i)
	{
		my $viewing = get_uploaded_files_url_path('without_trailing_slash');
		$viewing .= "/$path";
		slashify($viewing);
		if($viewing eq '/')
		{
			$viewing_title = $TEXT{Viewing_};
			$viewing_title .= " /" unless $PREF{hide_leading_slash_in_breadcrumbs} =~ /yes/i;
			$viewing_title .= qq` <a href="$PREF{here_filelist_qsready}action=listfiles$PREF{default_url_vars}">$PREF{name_of_top_level}</a>` unless $hide_topmost_level;
			$viewing_title .= " /" unless $PREF{hide_trailing_slash_in_breadcrumbs} =~ /yes/i || $viewing_title =~ m!/\s*$!;
		}
		else
		{
			my $breadcrumbs_path = $viewing;
			my $breadcrumbs = '/ ';

			if($PREF{hide_path_to_uploads_dir} =~ /yes/i)
			{
				$breadcrumbs .= qq`<a href="$PREF{here_filelist_qsready}action=listfiles$PREF{default_url_vars}">$PREF{name_of_top_level}</a> / ` unless $hide_topmost_level;
			}
			else
			{
				$breadcrumbs_path =~ s!^$PREF{uploaded_files_urlpath}!!;
				$breadcrumbs .= qq`<a href="$PREF{here_filelist_qsready}action=listfiles$PREF{default_url_vars}">$PREF{name_of_top_level}</a> / ` unless $hide_topmost_level;
			}

			my @parts = split(/\//, $breadcrumbs_path);
			my $accumulated_path = ();
			foreach my $part (@parts)
			{
				next unless $part;
				$accumulated_path .= $part . '/';
				next if ($part eq $PREF{userdir_folder_name}   &&   $PREF{hide_userdir_folder_name_in_breadcrumbs} =~ /yes/i   &&   $PREF{userdir}   &&   !logged_in_user_is_subgroup_manager());
				$breadcrumbs .= qq`<a href="$PREF{here_filelist_qsready}action=listfiles&amp;path=$accumulated_path$PREF{default_url_vars}">$part</a> / `;
			}
			$breadcrumbs =~ s!^/!! if $PREF{hide_leading_slash_in_breadcrumbs} =~ /yes/i;
			$breadcrumbs =~ s!/\s*$!! if $PREF{hide_trailing_slash_in_breadcrumbs} =~ /yes/i;
			$viewing_title = "$TEXT{Viewing_} $breadcrumbs";
		}
	}

	$output .= qq`\n<form method="post" action="$ENV{SCRIPT_NAME}?action=itemactions&amp;path=$path_urlencoded$PREF{default_url_vars}" name="itemactions" id="itemactions" onsubmit="return itemactions_verify()" >`;

	my $optmenutop = get_view_menu('top');
	my $viewpath_stuff =	  qq`$PREF{viewpath_markup_start}`
				. qq`<div id="viewpath-text">$viewing_title</div>`
				. qq`<div id="optmenutop">$optmenutop</div>`
				. qq`$PREF{viewpath_markup_end}`
				. qq`\n` if $viewing_title =~ /[^\s]/ || $optmenutop =~ /[^\s]/;



	my ($tr, $td) = ('', '');
	my $num_cols_printed = 0;
	if($PREF{current_filelist_mode} =~ /^list$/i)
	{
		$output .= qq`\n<table id="filelist">\n`;
		($tr, $td) = ('tr', 'td');

		$output .= qq`<tr class="first"><td colspan="20" id="viewpath-cell">$viewpath_stuff</td></tr>\n` if $viewpath_stuff;

		$output .= $column_headers;
	}
	else
	{
		$output .= qq`\n<table id="filegrid">\n`;
		($tr, $td) = ('div', 'div');

		$output .= qq`<tr><td colspan="20" id="viewpath-cell">$viewpath_stuff</td></tr>\n` if $viewpath_stuff;

		$PREF{custom_filelist_column_code__header}	= ''; 
		$PREF{custom_filelist_column_code__folders}	= '';
		$PREF{custom_filelist_column_code__files}	=~ s!<td!<div!g;
		$PREF{custom_filelist_column_code__files}	=~ s!</td>!</div>!g;
	}


	my $i = 0;
	my ($numfiles_displayed, $numdirs_displayed, $size_of_displayed_files) = (0,0,0);
	my ($range_start,$range_end) = get_pagination_range($PREF{num_items_per_page_on_filelist});
	my %rows = (); my $rowsi = 0;
	if($path)
	{
		my $test_path = $path;
		$test_path =~ s!^/!!g;
		$test_path =~ s!/$!!g;

		my ($parent_dir) = ($test_path =~ m!(.+)/!);
		$parent_dir = '' unless $parent_dir;
		$parent_dir = '' if $parent_dir eq $test_path;
		$parent_dir = '' if $parent_dir =~ m!^/?$PREF{userdir_folder_name}/?$!i && !$PREF{admin_is_logged_in};

		my $parent_dir_url = $parent_dir;
		enc_urlencode($parent_dir_url);
		$parent_dir_url = '&amp;path=' . $parent_dir_url if $parent_dir_url;

		unless(!$parent_dir_url && $hide_topmost_level)
		{
			if($PREF{current_filelist_mode} =~ /^grid$/i)
			{
				if($num_cols_printed == 0) { $output .= qq`\n<tr>`; }
				$output .= qq`<td class="prnt">`;
			}

			my $link = "$PREF{here_filelist_qsready}action=listfiles$parent_dir_url$PREF{default_url_vars}";

			my $thumbnail = '';
			if($PREF{current_filelist_mode} =~ /^grid$/i)
			{
				$thumbnail = qq`<a href="$link" class="icon"><img src="$PREF{app_images_url}$PREF{gridmode_arrow_icon}" class="icon" alt="folder icon" /></a>`;
			}

			$output .= qq`<$tr class="parentrow ` . oddeven($i) . qq`"><$td class="pname` . ($thumbnail ? ' thumb' : '') . qq`"> $thumbnail <a href="$link">$TEXT{Parent_Directory}</a></$td>`;


			my $customcol = $PREF{custom_filelist_column_code__folders};
			$customcol =~ s/%%\w+%%//g;
			$output .= $customcol;

			$output .= qq`<$td class="buy"$hidebuy></$td>`;

			$output .= qq`<$td class="size"$hidesize>--</$td>`;

			$parent_dir = $parent_dir ? "$PREF{uploaded_files_realpath}/$parent_dir" : $PREF{uploaded_files_realpath}; # must remove trailing slash or stat doesn't work on Win32.
			my $mtime = strftime($dateformat, localtime((stat($parent_dir))[9] + $PREF{time_offset}));
			my $ctime = strftime($dateformat, localtime((stat($parent_dir))[10] + $PREF{time_offset}));
			$output .= qq`<$td class="date"$hidedate>$mtime</$td>`;

			$output .= qq`<$td class="info"></$td>` if display_info_column();
			$output .= qq`<$td class="cp"></$td>`;
			$output .= qq`<$td class="mv"></$td>`;
			$output .= qq`<$td class="del"></$td>`;
			$output .= qq`<$td class="opt"></$td>`;
			$output .= qq`<$td class="sel"></$td>`;
			$output .= qq`<$td class="mopts"></$td>`;
			$output .= qq`<$td class="perms"></$td>` if custom_folder_perms_enabled();
			$output .= qq`<$td class="addbuy"></$td>` if cornerstore_integration_enabled();
			$output .= qq`<$td class="act"></$td>` if display_item_action_checkboxes();
			$output .= qq`<$td class="spc"></$td>`;

			$output .= qq`</$tr>\n`;

			if($PREF{current_filelist_mode} =~ /^grid$/i)
			{
				$output .= qq`</td>`;
				$num_cols_printed++;

				if($num_cols_printed == $PREF{num_columns_in_grid_mode})
				{
					$output .= qq`</tr>\n`;
					$num_cols_printed = 0;
				}
			}
		}
	}
	foreach my $dir (@dirs)
	{
		#my $starttime_dir = gettimeofday();

		my ($my_path_urlencoded, $dir_urlencoded, $fulldir, $dirclass) = ();
		my $special_toplevel_userdir_processing = 0;
		if($dir =~ m!^::special:userdir_shortcut::($PREF{userdir_folder_name})/($PREF{userdir})$!)
		{
			$special_toplevel_userdir_processing = 1;

			my $my_path = $1;
			$dir = $2;
			($my_path_urlencoded, $dir_urlencoded) = ("$my_path/$dir", '');
			$fulldir = "$PREF{uploaded_files_realpath}/$my_path/$dir";
			$dirclass= "homeicon";
		}
		elsif($dir =~ m!^::special:SGM_userdir_shortcut::($PREF{userdir_folder_name})/([^/]+)$!)
		{
			$special_toplevel_userdir_processing = 1;

			my $my_path = $1;
			$dir = $2;
			($my_path_urlencoded, $dir_urlencoded) = ("$my_path/$dir", '');
			$fulldir = "$PREF{uploaded_files_realpath}/$my_path/$dir";
			$dirclass= "homeicon";
		}
		else
		{
			# normal processing.
			$my_path_urlencoded = $path;
			$dir_urlencoded = $dir;
			$fulldir = "$PREF{uploaded_files_realpath}/$path/$dir";
			$dirclass= "diricon";
		}
		$my_path_urlencoded = urlencode_path_but_leave_slashes($my_path_urlencoded);
		enc_urlencode($dir_urlencoded);
		condense_slashes('leave_leading_UNC', $fulldir);

		# also hide the users folder when userdirs are enabled.
		next if $PREF{enable_userdirs} =~ /yes/i   &&   this_is_the_userdir_folder($dir)   &&   !(user_is_allowed_to('read_all_userdirs') || logged_in_user_is_subgroup_manager());

		# We'll display the users folder for subgroup managers, but we'll only show the subdirs that belong to his own users.
		next if logged_in_user_is_subgroup_manager() && this_is_the_userdir_folder($path) && !is_userdir_folder_that_this_user_can_read("$path/$dir");

		next unless folder_is_allowed_to_be_displayed("$my_path_urlencoded/$dir_urlencoded");
		encdebug time . ": processing dir: $dir\n"; # note: must print to STDERR; don't use printd here. (update: why not?)

		$rowsi++; next unless $range_start <= $rowsi && $rowsi <= $range_end;

		$numdirs_displayed++;

		if($PREF{current_filelist_mode} =~ /^grid$/i)
		{
			if($num_cols_printed == 0) { $rows{$rowsi}{wholerow} .= qq`\n<tr>`; }
			$rows{$rowsi}{wholerow} .= qq`<td class="dir">`;
		}

		my $displayname = $dir;
		$displayname =~ s!_! !g unless $PREF{display_underscores_as_spaces_on_filelist} =~ /no/i;
		my $tooltip = '';
		if(   ($PREF{shortened_display_filename_length} =~ /^(\d+)$/)   &&   (length($displayname) > $1)   )
		{
			my $length = $1;
			$displayname =~ s/^(.{$length}).*/$1.../;
			$tooltip = $dir;
		}

		my ($numfiles, $numdirs) = count_items($fulldir,'ignore_hidden_items');
		my $item_count = $numfiles;
		my ($numfiles_total, $numdirs_total) = count_items($fulldir);

		my $link = "$PREF{here_filelist_qsready}action=listfiles&amp;path=$my_path_urlencoded$dir_urlencoded$PREF{default_url_vars}";

		my ($thumbnail, $thumbw, $thumbh, $dirname_prefix) = ('', '', '', '');
		if(folder_thumbnails_enabled() && image_thumbnails_possible() && !$special_toplevel_userdir_processing)
		{
			if(my $mediafile = find_first_image_in_dir($fulldir,$PREF{max_image_size_to_resize}))
			{
				($thumbnail,$thumbw,$thumbh) = get_filelist_folder_thumbnail($fulldir,$path,$dir,$mediafile,$link,$displayname);
			}
		}

		if(!$thumbnail && folder_thumbnails_enabled() && video_thumbnails_possible() && video_thumbnails_enabled() && !$special_toplevel_userdir_processing)
		{
			if(my $mediafile = find_first_video_in_dir($fulldir))
			{
				($thumbnail,$thumbw,$thumbh) = get_filelist_folder_thumbnail($fulldir,$path,$dir,$mediafile,$link,$displayname);
			}
		}

		if(!$thumbnail)
		{
			if($PREF{current_filelist_mode} =~ /^grid$/i)
			{
				$thumbnail = qq`<a href="$link" class="icon"><img src="$PREF{app_images_url}` . ($special_toplevel_userdir_processing ? $PREF{gridmode_home_icon} : $PREF{gridmode_folder_icon}) . qq`" class="icon" alt="folder icon" /></a>`;
			}
		}
		else
		{
			$dirname_prefix = $PREF{prefix_for_thumbnailed_dir_names};
		}

		$rows{$rowsi}{wholerow} .= qq`<$tr class="dirrow ` . oddeven($i) . qq`"><$td class="dname $dirclass` . ($thumbnail ? ' thumb' : '') . qq`"> $thumbnail <a href="$link" title="$tooltip">$dirname_prefix$displayname</a></$td>`;

		my $customcol = $PREF{custom_filelist_column_code__folders};
		$customcol =~ s/%%\w+%%//g;
		$rows{$rowsi}{wholerow} .= $customcol;

		my $buy_details_ref = get_buy_details( { path => "$path$dir" } ); my %buy_details = %$buy_details_ref if $buy_details_ref;
		$rows{$rowsi}{wholerow} .= qq`<$td class="buy"$hidebuy>$buy_details{link_html}</$td>`;

		$rows{$rowsi}{wholerow} .= qq`<$td class="size"$hidesize>($item_count ` . ($item_count == 1 ? $TEXT{file} : $TEXT{files}) . qq`)</$td>`;

		my $mtime = strftime($dateformat, localtime((stat($fulldir))[9] + $PREF{time_offset}));
		my $ctime = strftime($dateformat, localtime((stat($fulldir))[10] + $PREF{time_offset}));
		$rows{$rowsi}{wholerow} .= qq`<$td class="date"$hidedate>$mtime</$td>`;

		my $perms_link = custom_folder_perms_enabled() ? get_perms_link($my_path_urlencoded,$dir_urlencoded) : '';;
		my $addbuy_link = qq`<a href="$PREF{here_qsready}action=saleopts&amp;createmode=true&amp;format=vert&amp;basepath=$my_path_urlencoded&amp;folder=$dir_urlencoded&amp;origref=` . get_origref() . qq`">$TEXT{add_a_buy_link}</a>`;
		my $mv_link  = $special_toplevel_userdir_processing ? '' :  display_mv_column($my_path_urlencoded) ? qq`<a href="$PREF{here_filelist_qsready}action=move&amp;folder=$dir_urlencoded&amp;src=$my_path_urlencoded">mv</a>` : '';

		my $js_del_code = "if(window.confirm('$TEXT{This_folder_contains} $numfiles_total $TEXT{files} $TEXT{and} $numdirs_total $TEXT{subfolders_including_any_hidden_items_}  $TEXT{Are_you_sure_you_want_to_delete_it___}')) { location.href='$PREF{here_filelist}?${userdir}action=delete&amp;path=$my_path_urlencoded&amp;folder=$dir_urlencoded'; } return false;";
		my $del_link = $special_toplevel_userdir_processing ? '' : display_del_column($my_path_urlencoded) ? qq`<a href="#" title="$js_del_code">del</a>` : ''; # use title instead of onclick because IE does weird crap to onclick which makes it hard to process (and breaks Opera) in the JS.

		my $opt_link = user_is_allowed_to('view_options_menus_on_filelist') ? $TEXT{options} : '';

		$rows{$rowsi}{wholerow} .= qq`<$td class="info"></$td>` if display_info_column();
		$rows{$rowsi}{wholerow} .= qq`<$td class="cp"></$td>`;
		$rows{$rowsi}{wholerow} .= qq`<$td class="mv">$mv_link</$td>`;
		$rows{$rowsi}{wholerow} .= qq`<$td class="del">$del_link</$td>`;
		$rows{$rowsi}{wholerow} .= qq`<$td class="opt"><a href="#" onclick="showoptsmenu(this); return false">$opt_link</a></$td>`;
		$rows{$rowsi}{wholerow} .= qq`<$td class="sel"></$td>`;
		$rows{$rowsi}{wholerow} .= qq`<$td class="mopts"></$td>`;
		$rows{$rowsi}{wholerow} .= qq`<$td class="perms">$perms_link</$td>` if custom_folder_perms_enabled();
		$rows{$rowsi}{wholerow} .= qq`<$td class="addbuy">$addbuy_link</$td>` if cornerstore_integration_enabled() && user_is_allowed_to('create_buy_links');
		$rows{$rowsi}{wholerow} .= qq`<$td class="act"><input type="checkbox" name="dir-$dir" class="itemaction" /></$td>` if display_item_action_checkboxes();
		$rows{$rowsi}{wholerow} .= qq`<$td class="spc"></$td>`;

		$rows{$rowsi}{wholerow} .= qq`</$tr>\n`;

		if($PREF{current_filelist_mode} =~ /^grid$/i)
		{
			$rows{$rowsi}{wholerow} .= qq`</td>`;
			$num_cols_printed++;

			if($num_cols_printed == $PREF{num_columns_in_grid_mode})
			{
				$rows{$rowsi}{wholerow} .= qq`</tr>\n`;
				$num_cols_printed = 0;
			}
		}

		#my $elapsedtime_dir = gettimeofday() - $starttime_dir; printd "$elapsedtime_dir sec for dir $dir\n" if $elapsedtime_dir !~ /^0\.0/;
	}

	if(folder_is_allowed_to_be_displayed($path_urlencoded))
	{
		foreach my $file (@files)
		{
			#my $starttime_file = gettimeofday();

			next unless file_is_allowed_to_be_displayed($path,$file);
			encdebug time . ": processing file: $file\n"; # note: must print to STDERR; don't use printd here. (update: why not?)

			$rowsi++; next unless $range_start <= $rowsi && $rowsi <= $range_end;

			$numfiles_displayed++;

			if($PREF{current_filelist_mode} =~ /^grid$/i)
			{
				if($num_cols_printed == 0) { $rows{$rowsi}{wholerow} .= qq`\n<tr>`; }
				$rows{$rowsi}{wholerow} .= qq`<td class="file">`;
			}

			my $displayname = $file;
			$displayname =~ s!_! !g unless $PREF{display_underscores_as_spaces_on_filelist} =~ /no/i;
			my $tooltip = '';
			if(   ($PREF{shortened_display_filename_length} =~ /^(\d+)$/)   &&   (length($displayname) > $1)   )
			{
				my $length = $1;
				if($displayname =~ /\./)
				{
					my ($start,$end) = ($displayname =~ /^(.+)(\..+)$/);
					$start =~ s/^(.{$length}).*/$1/;
					$displayname = length("$start...$end") < length($displayname) ? "$start...$end" : $displayname;
				}
				else
				{
					$displayname =~ s/^(.{$length}).*/$1.../;
				}
				$tooltip = $file;
			}
			if($displayname =~ /[^\.]\.[^\.]+$/   &&   ($PREF{hide_file_extensions_in_filelist___from_last_dot} =~ /yes/i || $PREF{hide_file_extensions_in_filelist___from_first_dot} =~ /yes/i))
			{
				if($PREF{hide_file_extensions_in_filelist___from_first_dot} =~ /yes/i)		{ $displayname =~ s/^(.+?)\..*/$1/; }
				elsif($PREF{hide_file_extensions_in_filelist___from_last_dot} =~ /yes/i)	{ $displayname =~ s/^(.+)\..*/$1/; }
				$tooltip = $file;
			}

			my $file_urlencoded = enc_urlencode_return($file);
			my $filename_link = get_download_link('filelist_page', $path, $file, $path_urlencoded, $file_urlencoded);

			my ($thumbnail, $thumbw, $thumbh, $using_mimetype_icon) = ('', '', '', 0);
			if(image_thumbnails_possible() && file_thumbnails_enabled() && is_image($file) && -s "$PREF{uploaded_files_realpath}/$path$file" < $PREF{max_image_size_to_resize})
			{
				($thumbnail,$thumbw,$thumbh) = get_filelist_thumbnail($path,$file,$filename_link,$displayname);
			}

			if(!$thumbnail && video_thumbnails_possible() && video_thumbnails_enabled() && is_video($file))
			{
				($thumbnail,$thumbw,$thumbh) = get_filelist_thumbnail($path,$file,$filename_link,$displayname);
			}

			if(!$thumbnail)
			{
				my ($extension) = ($file =~ /.*\.(.+?)$/);
				my $mimetype_icon = "mimetype_icon_for_$extension";
				if($PREF{$mimetype_icon})
				{
					$thumbnail = qq`<a href="$filename_link" class="thumb" $PREF{filelist_item_link_attribs}><img src="$PREF{$mimetype_icon}" class="mimeicon" alt="file icon" /></a>`;
					$using_mimetype_icon = 1;
				}
			}
			if(!$thumbnail   &&   $PREF{current_filelist_mode} =~ /^grid$/i)
			{
				$thumbnail = qq`<a href="$filename_link" class="icon" $PREF{filelist_item_link_attribs}><img src="$PREF{app_images_url}$PREF{gridmode_file_icon}" class="icon" alt="file icon" /></a>`;
			}

			my $link_id = $file; $link_id =~ s!\W!!g; $link_id = qq`id="fclink-$link_id"` if $link_id;
			$rows{$rowsi}{wholerow} .= qq`<$tr class="filerow ` . oddeven($i) . qq`"><$td class="fname` . ($thumbnail ? ' thumb' : '') . qq`" ` . ($using_mimetype_icon ? 'style="background-image: none;"' : '') . qq`> $thumbnail <a href="$filename_link" title="$tooltip" $link_id $PREF{filelist_item_link_attribs}>$displayname</a></$td>`;

			my $customcol = $PREF{custom_filelist_column_code__files};
			$customcol =~ s!%%(\w+)%%!get_file_metadata($path,$file,$1)!eg;
			$rows{$rowsi}{wholerow} .= $customcol;

			my $buy_details_ref = get_buy_details( { path => $path, file => $file } ); my %buy_details = %$buy_details_ref if $buy_details_ref;
			$rows{$rowsi}{wholerow} .= qq`<$td class="buy"$hidebuy>$buy_details{link_html}</$td>`;

			my $rawsize = my $size = -s "$PREF{uploaded_files_realpath}/$path$file";
			$size_of_displayed_files += $rawsize;
			my $numdec = $PREF{num_decimals_for_uploaded_files_list_sizes} =~ /^(\d+)$/ ? $1 : 0;
			if($PREF{unit_for_size_display_in_uploaded_files_list} =~ /MB/i)
			{
				$size = sprintf("%.${numdec}f", $size /= 1024*1024);
				$size .= " $PREF{MB}";
			}
			elsif($PREF{unit_for_size_display_in_uploaded_files_list} =~ /KB/i)
			{
				$size = sprintf("%.${numdec}f", $size /= 1024);
				$size .= " $PREF{KB}";
			}
			else
			{
				if($size >= 1024*1024)
				{
					$size = sprintf("%.${numdec}f", $size /= 1024*1024);
					$size .= " $PREF{MB}";
				}
				else
				{
					$size = sprintf("%.${numdec}f", $size /= 1024);
					$size .= " $PREF{KB}";
				}
			}
			$size =~ s/^0 /1 / if $rawsize > 0; # for tiny files, round to 1 instead of 0.
			$rows{$rowsi}{wholerow} .= qq`<$td class="size"$hidesize>$size</$td>`;


			my $fulldir = "$PREF{uploaded_files_realpath}/$path";
			my $mtime = strftime($dateformat, localtime((stat("$fulldir$file"))[9] + $PREF{time_offset}));
			my $ctime = strftime($dateformat, localtime((stat("$fulldir$file"))[10] + $PREF{time_offset}));
			$rows{$rowsi}{wholerow} .= qq`<$td class="date"$hidedate>$mtime</$td>`;

			my $info_link = user_is_allowed_to('view_upload_info') && info_system_is_enabled() ? qq`<a href="$PREF{here_filelist_qsready}action=fileinfo&amp;path=$path_urlencoded&amp;file=$file_urlencoded$PREF{default_url_vars}">info</a>` : '--';
			$rows{$rowsi}{wholerow} .= qq`<$td class="info">$info_link</$td>` if display_info_column();

			my $cp_link = display_cp_column() ? qq`<a href="$PREF{here_filelist_qsready}action=movecopy&amp;file=$file_urlencoded&amp;src=$path_urlencoded$PREF{default_url_vars}">cp</a>` : '';
			$rows{$rowsi}{wholerow} .= qq`<$td class="cp">$cp_link</$td>`;

			my $mv_link = display_mv_column($path_urlencoded) ? qq`<a href="$PREF{here_filelist_qsready}action=move&amp;file=$file_urlencoded&amp;src=$path_urlencoded$PREF{default_url_vars}">mv</a>` : '';
			$rows{$rowsi}{wholerow} .= qq`<$td class="mv">$mv_link</$td>`;

			my $js_del_code = "if(window.confirm('$TEXT{Are_you_sure_you_want_to_delete_this___}')) { location.href='$PREF{here_filelist_qsready}action=delete&amp;path=$path_urlencoded&amp;file=$file_urlencoded$PREF{default_url_vars}'; } return false;";
			my $del_link = display_del_column($path_urlencoded) ? qq`<a href="#" title="$js_del_code">del</a>` : '';
			$rows{$rowsi}{wholerow} .= qq`<$td class="del">$del_link</$td>`;

			my $opt_link = user_is_allowed_to('view_options_menus_on_filelist') ? $TEXT{options} : '';
			$rows{$rowsi}{wholerow} .= qq`<$td class="opt"><a href="#" onclick="showoptsmenu(this); return false">$opt_link</a></$td>`;

			my ($path_for_js, $file_for_js) = ($path, $file);
			for($path_for_js, $file_for_js) { s!'!\\'! if $_; }
			my $sel_link = display_sel_column() ? qq`<a href="#" title="select_item('$path_for_js$file_for_js');return false">$PREF{select_item_link}</a>` : '';
			$rows{$rowsi}{wholerow} .= qq`<$td class="sel">$sel_link</$td>`;



			$rows{$rowsi}{wholerow} .= qq`<$td class="mopts">`;

			if($PREF{viewer_link_on_options_menu})			{ $rows{$rowsi}{wholerow} .= qq`<a href="` . get_viewer_link($userdir, $path_urlencoded, $file_urlencoded)		. qq`">$PREF{viewer_link_on_options_menu}</a>`; }
			if($PREF{full_page_link_on_options_menu})		{ $rows{$rowsi}{wholerow} .= qq`<a href="` . get_full_page_link($userdir, $path_urlencoded, $file_urlencoded)		. qq`">` . (is_video($file) ? $PREF{full_page_link_on_options_menu___videos} : $PREF{full_page_link_on_options_menu}) . qq`</a>`; }
			if($PREF{script_download_link_on_options_menu})		{ $rows{$rowsi}{wholerow} .= qq`<a href="` . get_script_download_link($userdir, $path_urlencoded, $file_urlencoded)	. qq`">$PREF{script_download_link_on_options_menu}</a>`; }

			if($PREF{direct_download_link_on_options_menu} && $PREF{download_links_go_through_FileChucker} !~ /yes/i) { $rows{$rowsi}{wholerow} .= qq`<a href="` . get_direct_download_link($userdir, $path_urlencoded, $file_urlencoded) . qq`">$PREF{direct_download_link_on_options_menu}</a>`; }

			if(image_rotation_possible($file) && is_image($file) && user_is_allowed_to('rotate_images'))
			{
				if($PREF{enable_rotate90_action})		{ $rows{$rowsi}{wholerow} .= qq`<a href="$ENV{SCRIPT_NAME}?action=rotate_images90&amp;path=$path_urlencoded&amp;mode=single&amp;name=file-$file_urlencoded">$PREF{enable_rotate90_action}</a>`;		}
				if($PREF{enable_rotate180_action})		{ $rows{$rowsi}{wholerow} .= qq`<a href="$ENV{SCRIPT_NAME}?action=rotate_images180&amp;path=$path_urlencoded&amp;mode=single&amp;name=file-$file_urlencoded">$PREF{enable_rotate180_action}</a>`;		}
				if($PREF{enable_rotate270_action})		{ $rows{$rowsi}{wholerow} .= qq`<a href="$ENV{SCRIPT_NAME}?action=rotate_images270&amp;path=$path_urlencoded&amp;mode=single&amp;name=file-$file_urlencoded">$PREF{enable_rotate270_action}</a>`;		}
			}

			my $optionsmenu_emaillink = get_download_link('optionsmenu_emaillink', $path, $file, $path_urlencoded, $file_urlencoded);
			$optionsmenu_emaillink =~ s!&amp;!%26!g;
			if($PREF{email_link_on_options_menu})			{ $rows{$rowsi}{wholerow} .= qq`<a href="mailto:?body=$PREF{protoprefix}$ENV{HTTP_HOST}` . $optionsmenu_emaillink . qq`">$PREF{email_link_on_options_menu}</a>`; }

			$rows{$rowsi}{wholerow} .= qq`</$td>`;



			$rows{$rowsi}{wholerow} .= qq`<$td class="perms"></$td>` if custom_folder_perms_enabled();
			$rows{$rowsi}{wholerow} .= qq`<$td class="addbuy"><a href="$PREF{here_qsready}action=saleopts&amp;createmode=true&amp;format=vert&amp;basepath=$path_urlencoded&amp;file=$file_urlencoded&amp;origref=` . get_origref() . qq`">$TEXT{add_a_buy_link}</a></$td>` if cornerstore_integration_enabled() && user_is_allowed_to('create_buy_links');
			$rows{$rowsi}{wholerow} .= qq`<$td class="act"><input type="checkbox" name="file-$file" class="itemaction" /></$td>` if display_item_action_checkboxes();
			$rows{$rowsi}{wholerow} .= qq`<$td class="spc"></$td>`;

			$rows{$rowsi}{wholerow} .= qq`</$tr>\n`;

			if($PREF{current_filelist_mode} =~ /^grid$/i)
			{
				$rows{$rowsi}{wholerow} .= qq`</td>`;
				$num_cols_printed++;

				if($num_cols_printed == $PREF{num_columns_in_grid_mode})
				{
					$rows{$rowsi}{wholerow} .= qq`</tr>\n`;
					$num_cols_printed = 0;
				}
			}

			#my $elapsedtime_file = gettimeofday() - $starttime_file; printd "$elapsedtime_file sec for file $file\n" if $elapsedtime_file !~ /^0\.0/;
		}
	}

	foreach my $rowi (sort { $a <=> $b } keys %rows)
	{
		if($PREF{num_items_per_page_on_filelist})
		{
			# TODO: the if() here is technically no longer necessary, since we're doing the
			# same test in the dir & file loops above before inserting into %rows.
			$output .= $rows{$rowi}{wholerow} if $range_start <= $rowi && $rowi <= $range_end;
		}
		else
		{
			$output .= $rows{$rowi}{wholerow};
		}
	}

	#my $pagelinks = get_pagination_links_mark2($range_start, $range_end, $rowsi,
	#		$PREF{num_items_per_page_on_filelist},
	#		$PREF{filelist_itemname_singular},
	#		$PREF{filelist_itemname_plural},
	#		$PREF{filelist_pagename_singular},
	#		$PREF{filelist_pagename_plural},
	#		$PREF{filelist_pagination_links_template}
	#);

	my $pagelinks = get_pagination_links_mark2( {
			range_start => $range_start, range_end => $range_end,
			num_items => $rowsi, items_per_page => $PREF{num_items_per_page_on_filelist},
			itemname_singular => $PREF{filelist_itemname_singular},
			itemname_plural => $PREF{filelist_itemname_plural},
			pagename_singular => $PREF{filelist_pagename_singular},
			pagename_plural => $PREF{filelist_pagename_plural},
			template => $PREF{filelist_pagination_links_template},
			hide_sort_links => 1,
			hide_when_single_page => 1
	} );

	$output .= qq`<tr class="` . oddeven($i) . qq`"><td colspan="20" class="emptytable">(Folder is empty)</td></tr>\n` if (   ($PREF{enable_subdirs} =~ /yes/i && !@items)   ||   ($PREF{enable_subdirs} !~ /yes/i && !@files)   );

	$output .= qq`<tr class="actionrow"><td colspan="20" class="actionrow">`;

	if(display_item_action_checkboxes())
	{
		$output .= qq`<div class="arcontrols">`;
		$output .= get_actions_menu($path_urlencoded);
		$output .= qq`</div>`;

		$output .= qq`<div class="arlinks">`
			 . qq`<a href="#" onclick="select_all_items(1); return false">$TEXT{Select_All}</a>&nbsp; <a href="#" onclick="select_all_items(0); return false">$TEXT{Select_None}</a>`
			 . qq`</div>`
			 . qq``;
	}

	if($PREF{enable_summary_of_counts_and_sizes} =~ /yes/i)
	{
		my ($numfiles_total, $numdirs_total) = count_items($fulldir,'ignore_hidden_items');
		my $size_total = get_dir_size($fulldir);

		$numfiles_total	= $numfiles_total == 1 ? "1 file" : "$numfiles_total files";
		$numdirs_total	= $numdirs_total == 1 ? "1 folder" : "$numdirs_total folders";
		$size_total = format_filesize_nicely($size_total);

		$numfiles_displayed	= $numfiles_displayed == 1 ? "1 $TEXT{file}" : "$numfiles_displayed $TEXT{files}";
		$numdirs_displayed	= $numdirs_displayed == 1 ? "1 $TEXT{folder}" : "$numdirs_displayed $TEXT{folders}";
		$size_of_displayed_files= format_filesize_nicely($size_of_displayed_files);

		$output .=
			  qq`<div class="sizeinfo">`
			. (@dirs ? '<a href="#" class="toggle-counts" onclick="toggle_file_counts(); return false">' : '')
			. qq`$TEXT{Contents_}`
			. (@dirs ? '</a>' : '')
			. qq` <span id="counts-excl-subfolders">$numfiles_displayed / $numdirs_displayed / $size_of_displayed_files</span>`
			. (@dirs ? qq` <span id="counts-incl-subfolders" style="display: none;">$numfiles_total / $numdirs_total / $size_total $TEXT{_incl_subfolders_}</span>` : '')
			. qq`</div>\n`;
	}

	$output .=	  qq`<div class="clear">&nbsp;</div>`;
	
	if(display_item_action_checkboxes())
	{
		$output .= qq`<div id="copymovedest_wrapper">Choose destination: <select name="copymovedest" id="copymovedest">\n`;
		$output .= qq`<option value=""></option>\n`;
		foreach my $dir (get_all_writable_directories())
		{
			slashify($dir);
			next if item_is_hidden($dir);
			$output .= qq`<option value="$dir">` . get_uploaded_files_url_path('without_trailing_slash') . qq`$dir</option>\n`;
		}
		$output .= qq`</select>\n</div>\n`;
	}

	$output .=	  qq`</td></tr>\n`
			. qq``;

	$output .= qq`\n</table>\n\n</form>\n\n`;

	$output .= $pagelinks;

	print $output;

	finish_html_output('home', 'uploader', 'addfile', 'mkdir', 'administration', 'myaccount', 'logout', 'login', 'selections');
	
}


sub get_sorted_filelist_items($)
{
	my $fulldir = shift;
	my @items = ();
	if(-d $fulldir)
	{
		my $qs_has_sort = $qs =~ /(?:^|&)s=[sdn]r?(?:&|$)/;

		opendir(FILELISTDIRH, $fulldir) or die "$0: couldn't open $fulldir: $!\n";
		my $dirh = \*FILELISTDIRH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".

		   if($qs =~ /(?:^|&)s=s(?:&|$)/   || (!$qs_has_sort && $PREF{default_filelist_sort} eq 's'))	{ @items = grep { !/^(\.|\.\.|\.ht*)$/ } sort { (stat("$fulldir/$a"))[7] <=> (stat("$fulldir/$b"))[7] } readdir($dirh);		}
		elsif($qs =~ /(?:^|&)s=sr(?:&|$)/  || (!$qs_has_sort && $PREF{default_filelist_sort} eq 'sr'))	{ @items = grep { !/^(\.|\.\.|\.ht*)$/ } sort { (stat("$fulldir/$b"))[7] <=> (stat("$fulldir/$a"))[7] } readdir($dirh);		}

		elsif($qs =~ /(?:^|&)s=d(?:&|$)/   || (!$qs_has_sort && $PREF{default_filelist_sort} eq 'd'))	{ @items = grep { !/^(\.|\.\.|\.ht*)$/ } sort { (stat("$fulldir/$a"))[9] <=> (stat("$fulldir/$b"))[9] } readdir($dirh);		}
		elsif($qs =~ /(?:^|&)s=dr(?:&|$)/  || (!$qs_has_sort && $PREF{default_filelist_sort} eq 'dr'))	{ @items = grep { !/^(\.|\.\.|\.ht*)$/ } sort { (stat("$fulldir/$b"))[9] <=> (stat("$fulldir/$a"))[9] } readdir($dirh);		}

		elsif($qs =~ /(?:^|&)s=nr(?:&|$)/  || (!$qs_has_sort && $PREF{default_filelist_sort} eq 'nr'))	{ @items = grep { !/^(\.|\.\.|\.ht*)$/ } sort { lc($b) cmp lc($a) } readdir($dirh);	}
		else												{ @items = grep { !/^(\.|\.\.|\.ht*)$/ } sort { lc($a) cmp lc($b) } readdir($dirh);	}

		closedir($dirh) or die "$0: couldn't close $fulldir: $!\n";
	}
	return @items;
}


sub get_actions_menu($)
{
	return unless display_item_action_checkboxes();

	my $path_urlencoded = shift;

	my $form =	  qq`\n<select name="itemaction" id="actiontodo" onchange="showhide_copymovedest_selector()">`
			. qq`\n<option value="">$TEXT{Actions_Menu}</option>`
			. qq`\n`;

	if($PREF{multi_item_copy_label}			&&   display_cp_column())							{ $form .= qq`<option value="copy_items">$PREF{multi_item_copy_label}</option>`;					}
	#
	# TODO:
	#if($PREF{multi_item_move_label}		&&   display_mv_column($path_urlencoded))					{ $form .= qq`<option value="move_items">$PREF{multi_item_move_label}</option>`;					}
	#
	if($PREF{enable_replace_mode} =~ /yes/i		&&   user_is_allowed_to('replace_existing_files'))				{ $form .= qq`<option value="replace_items">$PREF{label_for_replace_action}</option>`;		}
	if($PREF{enable_reprocessing_mode} =~ /yes/i	&&   user_is_allowed_to('reprocess_existing_files'))				{ $form .= qq`<option value="reprocess_items">$PREF{label_for_reprocess_action}</option>`;	}
	#if($PREF{enable_unzip_action}			&&   user_is_allowed_to('unzip_files'))						{ $form .= qq`<option value="unzip_files">$PREF{enable_unzip_action}</option>`;			}
	if($PREF{enable_delete_action}			&&   user_is_allowed_to('delete_items'))					{ $form .= qq`<option value="delete_items">$PREF{enable_delete_action}</option>`;		}
	if($PREF{enable_multidownload_action}		&&   user_is_allowed_to('download'))						{ $form .= qq`<option value="multidownload">$PREF{enable_multidownload_action}</option>`;	}
	if($PREF{enable_rotate90_action}		&&   user_is_allowed_to('rotate_images')	&& image_rotation_possible())	{ $form .= qq`<option value="rotate_images90">$PREF{enable_rotate90_action}</option>`;		}
	if($PREF{enable_rotate180_action}		&&   user_is_allowed_to('rotate_images')	&& image_rotation_possible())	{ $form .= qq`<option value="rotate_images180">$PREF{enable_rotate180_action}</option>`;	}
	if($PREF{enable_rotate270_action}		&&   user_is_allowed_to('rotate_images')	&& image_rotation_possible())	{ $form .= qq`<option value="rotate_images270">$PREF{enable_rotate270_action}</option>`;	}

	$form .=	  qq`\n</select>`
			. qq`\n<input type="button" onclick="itemactions_verify()" value="$TEXT{Go}" id="actionssubmit" class="default button submit" />`
			. qq`\n`;
}


sub display_item_action_checkboxes
{
	return user_is_allowed_to('view_actions_menu_on_filelist') && $PREF{enable_item_action_checkboxes} =~ /yes/i;
}


sub display_info_column
{
	return user_is_allowed_to('view_upload_info') && info_system_is_enabled();
}


sub display_cp_column
{
	#printd "display_cp_column()\n";

	return   user_is_allowed_to('copy_items');
}


sub display_mv_column
{
	#printd "display_mv_column()\n";

	my $item = shift;
	if(custom_folder_perms_enabled())
	{
		return   user_is_allowed_to('move_items')   &&   $PREF{enable_subdirs} =~ /yes/i   &&   folder_perms_allow_reading_and_writing($item);
	}
	else
	{
		return   user_is_allowed_to('move_items')   &&   $PREF{enable_subdirs} =~ /yes/i;
	}
}


sub display_sel_column()
{
	return user_is_allowed_to('order_items') && $PREF{enable_ordering} =~ /yes/i;
}


sub display_showcart_link_in_linkbar()
{
	return user_is_allowed_to('order_items') && $PREF{enable_ordering} =~ /yes/i;
}


sub display_del_column
{
	#printd "display_del_column()\n";

	my $item = shift;
	if(custom_folder_perms_enabled())
	{
		return   user_is_allowed_to('delete_items')   &&   folder_perms_allow_reading_and_writing($item);
	}
	else
	{
		return   user_is_allowed_to('delete_items');
	}
}


sub cornerstore_integration_enabled()
{
	return $PREF{integrate_with_cornerstore} =~ /yes/i;
}


sub get_filelist_thumbnail($$$$)
{
	my ($path,$file,$link,$displayname) = @_;

	(my $thumbclass,		my $thumbdir				)	= is_video($file)
	? ('fcvidthumb',		$PREF{video_thumbnail_dir_name}		)
	: ('fcthumb',			$PREF{filelist_thumbnail_dir_name}	);

	my $pathtothumbs = "$PREF{uploaded_files_realpath}/$path/$thumbdir";
	condense_slashes('leave_leading_UNC', $pathtothumbs);
	$pathtothumbs = enc_untaint($pathtothumbs, 'keep_path');
	create_dir_if_DNE($pathtothumbs,$PREF{writable_dir_perms});

	my $mediafile = "$PREF{uploaded_files_realpath}/$path$file";
	my $thumb = enc_untaint("$pathtothumbs/$file", 'keep_path');
	$thumb = get_video_thumb_filename($thumb);

	if(!-e $thumb   ||   force_update_of_thumbs_cache()   ||   (stat("$mediafile"))[9] > (stat("$thumb"))[9])
	{
		is_video($mediafile) ? make_video_thumbnail($mediafile, $thumb) : make_thumbnail($mediafile, $thumb);
	}

	my ($thumbw,$thumbh) = get_image_dims($thumb);
	my $thumbsrc = "$PREF{uploaded_files_urlpath}/$path/$thumbdir/$file";
	$thumbsrc = get_video_thumb_filename($thumbsrc);
	condense_slashes($thumbsrc);
	my $dims = $thumbw && $thumbh ? qq`width="$thumbw" height="$thumbh"` : '';
	my $thumbnail = qq`<a href="$link" class="thumb" $PREF{filelist_item_link_attribs}><img src="$thumbsrc" $dims class="$thumbclass" alt="thumbnail image for $displayname" /></a>` if -e $thumb && (is_video($mediafile)   ||   (-s $mediafile < $PREF{max_image_size_to_resize}));

	return ($thumbnail,$thumbw,$thumbh);
}


sub get_filelist_folder_thumbnail($$$$$$)
{
	my ($fulldir,$path,$dir,$mediafile,$link,$displayname) = @_;
	my $mediafile_nopath = $mediafile;

	my ($mediafile_localpath) = ($mediafile =~ m!^$fulldir(.*)!);
	$mediafile_localpath =~ s![^/\\]+$!!;
	$mediafile_nopath =~ s!.*[/\\]!!;
	$mediafile_nopath = get_video_thumb_filename($mediafile_nopath);

	(my $thumbclass,		my $thumbdir				)	= is_video($mediafile)
	? ('fcvidthumb',		$PREF{video_thumbnail_dir_name}		)
	: ('fcthumb',			$PREF{filelist_thumbnail_dir_name}	);

	my $pathtothumbssub = "$fulldir/$mediafile_localpath/$thumbdir";
	condense_slashes('leave_leading_UNC', $pathtothumbssub);
	$pathtothumbssub = enc_untaint($pathtothumbssub, 'keep_path');
	create_dir_if_DNE($pathtothumbssub,$PREF{writable_dir_perms});

	my $thumb = enc_untaint("$pathtothumbssub/$mediafile_nopath", 'keep_path');
	if(!-e $thumb   ||   force_update_of_thumbs_cache()   ||   (stat("$mediafile"))[9] > (stat("$thumb"))[9])
	{
		is_video($mediafile) ? make_video_thumbnail($mediafile, $thumb) : make_thumbnail($mediafile, $thumb);
	}

	my ($thumbw,$thumbh) = get_image_dims($thumb);
	my $src = "$PREF{uploaded_files_urlpath}/$path/$dir/$mediafile_localpath/$thumbdir/$mediafile_nopath";
	condense_slashes($src);
	my $dims = $thumbw && $thumbh ? qq`width="$thumbw" height="$thumbh"` : '';
	my $thumbnail = qq`<a href="$link" class="thumb"><img src="$src" $dims class="$thumbclass" alt="thumbnail image for $displayname" /></a>` if -e $thumb && (is_video($mediafile)   ||   (-s $mediafile < $PREF{max_image_size_to_resize}));

	return ($thumbnail,$thumbw,$thumbh);
}


# When calling these subs, path and file must be urlencoded first, and userdir must be from get_userdir_for_qs().
sub get_peerfactor_link		{ my ($userdir, $path, $file) = @_; return "http://www.peerfactor.fr/get_myfile.jsp?URL=" . "$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{uploaded_files_urlpath}/$path$file"; }
sub get_landing_page_link	{ my ($userdir, $path, $file) = @_; return "$ENV{SCRIPT_NAME}?${userdir}action=landing&amp;path=$path&amp;file=$file"; }
sub get_viewer_link		{ my ($userdir, $path, $file) = @_; return "$PREF{here_viewer_qsready}${userdir}action=viewer&amp;path=$path&amp;file=$file"; }
sub get_full_page_link		{ my ($userdir, $path, $file) = @_; return "$ENV{SCRIPT_NAME}?${userdir}action=viewinline&amp;path=$path&amp;file=$file"; }
sub get_script_download_link	{ my ($userdir, $path, $file) = @_; return "$ENV{SCRIPT_NAME}?${userdir}action=download&amp;path=$path&amp;file=$file"; }
sub get_direct_download_link	{ my ($userdir, $path, $file) = @_; return "$PREF{uploaded_files_urlpath}/$path$file"; } # the $path var ends in a slash.


sub get_download_link
{
	my ($context, $path, $file, $path_urlencoded, $file_urlencoded) = @_;

	$file_urlencoded = enc_urlencode_return($file) if !$file_urlencoded;
	$path_urlencoded = urlencode_path_but_leave_slashes($path) if !$path_urlencoded;

	($file,$path) = ($file_urlencoded, $path_urlencoded);

	my $link = '';
	my $userdir = get_userdir_for_qs();

	if($PREF{download_links_go_through_PeerFactor} =~ /yes/i)		{ $link = get_peerfactor_link($userdir, $path, $file);		}
	elsif($PREF{"file_links_in_${context}_go_to"} eq 'landing_page')	{ $link = get_landing_page_link($userdir, $path, $file);	}
	elsif($PREF{"file_links_in_${context}_go_to"} eq 'viewer')		{ $link = get_viewer_link($userdir, $path, $file);		}
	elsif($PREF{"file_links_in_${context}_go_to"} eq 'full_page')		{ $link = get_full_page_link($userdir, $path, $file);		}
	elsif($PREF{"file_links_in_${context}_go_to"} eq 'script_download')	{ $link = get_script_download_link($userdir, $path, $file);	}
	elsif($PREF{"file_links_in_${context}_go_to"} eq 'direct_download')
	{
		if($PREF{download_links_go_through_FileChucker} =~ /yes/i)
		{
			$link = get_full_page_link($userdir, $path, $file); # the full_page link is the one whose behavior is most similar to a direct_download link.
		}
		else
		{
			$link = get_direct_download_link($userdir, $path, $file);
		}
	}
	else
	{
		$link = get_direct_download_link($userdir, $path, $file);
	}

	condense_slashes($link);
	return $link;
}


sub display_item_in_viewer
{
	exit_with_needprivs() unless user_is_allowed_to('view_items_in_viewer_mode');
	$PREF{on_a_wide_page} = $PREF{use_wide_pages_in_viewer_mode} =~ /yes/i;

	my ($path, $file) = (get_qs_var('path'), get_qs_var('file'));
	$file = enc_untaint($file);
	$path = enc_untaint($path, 'keep_path') if $path;
	$path = "/$path" unless $path =~ m!^(/|\\|\w:[/\\])!;

	exit_with_error($TEXT{Insufficient_permissions_to_view_folder_}) unless folder_is_allowed_to_be_displayed(urlencode_path_but_leave_slashes($path));
	exit_with_error($TEXT{Insufficient_permissions_to_view_file_}) unless folder_perms_allow_reading($path);

	my $fulldir = "$PREF{uploaded_files_realpath}/$path";
	condense_slashes('leave_leading_UNC', $fulldir);
	my $fullfile = "$fulldir/$file";
	exit_with_error("That file does not exist.") unless -f $fullfile;
	exit_with_error("That file is a blank/empty file; there's nothing to download.") unless -s $fullfile;



	# Get the full list of files in this folder, so we can create
	# prev/next links and display a "File X of Y" label:

	my @items = get_sorted_filelist_items($fulldir);
	my (@dirs,@files) = ();

	for(@items)
	{
		#push (@dirs, $_) if ($PREF{enable_subdirs} =~ /yes/i   &&   -d "$fulldir/$_");
		push (@files, $_) if -f "$fulldir/$_";
	}

	my $numitems = 0;
	my $item_number = 0;
	my ($prev_item, $next_item, $a_prev_item) = ();
	foreach my $afile (@files)
	{
		next unless file_is_allowed_to_be_displayed($path,$afile);
		$numitems++;

		if($afile eq $file)
		{
			$prev_item = $a_prev_item;
			$item_number = $numitems;
		}
		if($a_prev_item eq $file)
		{
			$next_item = $afile;
		}

		$a_prev_item = $afile;
	}



	# If it's an image file, create a web-sized version (a "preview") of it:
	#
	my ($preview_file_url, $preview_width, $preview_height) = ();
	my $preview_size = ($PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_resizing} =~ /yes/i) || $PREF{try_to_use_convert_for_resizing} =~ /yes/i ? $PREF{viewer_mode_image_size__imagemagick} : gd_is_available() && $PREF{try_to_use_gd_for_resizing} =~ /yes/i ? $PREF{viewer_mode_image_size__gd} : '';
	if($PREF{resize_photos_in_viewer_mode} =~ /yes/i   &&   is_image($file)   &&   -s $fullfile <= $PREF{viewer_mode_image__skip_if_bigger_than}   &&   $preview_size)
	{
		my $preview_subfolder	= ($preview_size =~ /(\d+)/)[0];
		my $preview_path_local	= "$path/$PREF{name_of_subfolder_for_thumbnails_etc}/preview_$preview_subfolder";
		my $preview_path_url	= "$PREF{uploaded_files_urlpath}/$preview_path_local";
		my $preview_path_full	= "$PREF{uploaded_files_realpath}/$preview_path_local";
		condense_slashes('leave_leading_UNC', $preview_path_url, $preview_path_full);
		create_dir_if_DNE($preview_path_full, $PREF{writable_dir_perms}, 'make_parents');
		   $preview_file_url	= "$preview_path_url/$file";
		my $preview_file_full	= "$preview_path_full/$file";

		if(!-e $preview_file_full   ||   force_update_of_thumbs_cache()   ||   (stat("$fullfile"))[9] > (stat("$preview_file_full"))[9])
		{
			my ($origw,$origh) = get_image_dims($fullfile);
			my ($previeww,$previewh) = ($preview_size =~ /^(\d*)x?(\d*)$/i);
			if($origw > $previeww || $origh > $previewh || !$origw || !$previeww)
			{
				resize_image___withtimeout($PREF{image_resizing_timeout}, $fullfile, $preview_file_full, $preview_size);
				chmod $PREF{writable_file_perms}, $preview_file_full;
			}
			else
			{
				copy($fullfile, $preview_file_full) or die_nice "couldn't copy image file '$fullfile' to viewer-sized file '$preview_file_full': $!\n";
			}
		}

		($preview_width, $preview_height) = get_image_dims($preview_file_full);

		($preview_file_url, $preview_width, $preview_height) = () unless -e $preview_file_full;
	}



	my $template = $PREF{viewer_mode_output_template};
	$template =~ s!%%%if-image_file%%%(.*?)%%%endif-image_file%%%!$preview_file_url ? $1 : ''!egs;
	$template =~ s!%%%if-regular_file%%%(.*?)%%%endif-regular_file%%%!$preview_file_url ? '' : $1!egs;

	# Image stuff:
	$template =~ s!%%src_to_image%%!$preview_file_url!g;
	$template =~ s!%%image_dims%%!$preview_width && $preview_height ? qq`style="width: $preview_width; height: $preview_height;"` : ''!eg;

	# Generic stuff:
	$template =~ s!%%filename%%!$file!g;
	$template =~ s!%%item_number%%!$item_number!g;
	$template =~ s!%%numitems%%!$numitems!g;
	$template =~ s!%%%if-notfirstitem%%%(.*?)%%%end-notfirstitem%%%!$prev_item ? $1 : ''!egs;
	$template =~ s!%%%if-notlastitem%%%(.*?)%%%end-notlastitem%%%!$next_item ? $1 : ''!egs;
	$template =~ s!%%href_to_prev_item%%!$PREF{here_viewer_qsready}action=viewer&amp;path=$path&amp;file=$prev_item$PREF{default_url_vars}!g;
	$template =~ s!%%href_to_next_item%%!$PREF{here_viewer_qsready}action=viewer&amp;path=$path&amp;file=$next_item$PREF{default_url_vars}!g;
	$template =~ s!%%download_link%%!get_download_link('viewer_page', $path, $file)!eg;

	$template =~ s!%%(\w+)%%!get_file_metadata($path,$file,$1)!eg;

	# Remove any leftovers:
	$template =~ s!%%%if-(\w+)%%%(.*?)%%%end-\1%%%!!gs;
	$template =~ s!%%%if-(\w+)%%%(.*?)%%%endif-\1%%%!!gs;

	start_html_output();
	print $template;
	finish_html_output();
}



sub urlencode_path_but_leave_slashes
{
	my $input_path = shift;
	my @elements = split /[\/\\]+/, $input_path;
	my $whole = '';
	foreach my $element (@elements)
	{
		enc_urlencode($element);
		$whole .= $element . '/';
	}
	$whole =~ s!/+$!! unless $input_path =~ m![/\\]$!;
	$whole = '/' . $whole if $input_path =~ m!^[/\\]!;
	condense_slashes($whole);
	return $whole;
}


sub get_file_metadata($$$)
{
	my ($path,$file,$variable) = @_;
	$path = '/' unless $path;
	my $value = '';
	if($PREF{store_upload_info_in_database} =~ /yes/i)
	{
		sql_untaint($path,$file,$variable);
		die_unless_sqlsafe($path,$file,$variable);
		$value = enc_sql_select("SELECT `$variable` FROM `$PREF{upload_log_table}` WHERE `filepath` = '$path' AND `filename` = '$file'");
	}
	return $value;
}


# EB, FC
sub delete_old_files
{
	return unless
	(
		($PREF{max_age_for_uploads} =~ /^\d+(\.\d+)?$/ && $PREF{max_age_for_uploads} > 0)
	||
		($PREF{max_age_for_humantest_images} =~ /^\d+(\.\d+)?$/ && $PREF{max_age_for_humantest_images} > 0)
	||
		($PREF{max_age_for_logfiles} =~ /^\d+(\.\d+)?$/ && $PREF{max_age_for_logfiles} > 0)
	||
		($PREF{max_age_for_multidownload_zip_files} =~ /^\d+(\.\d+)?$/ && $PREF{max_age_for_multidownload_zip_files} > 0)
	);

	my $current_hour = strftime("%H",localtime(offsettime()));
	my $current_minute = strftime("%M",localtime(offsettime()));
	for($current_hour, $current_minute)
	{
		s/^0// unless /^0$/; # because sftftime outputs leading zeros, but the user probably won't enter them that way.
	}

	my %hours_at_which_to_check = map { $_ => 1 } split(/[,\s]+/, $PREF{hours_at_which_to_check});
	my %minutes_at_which_to_check = map { $_ => 1 } split(/[,\s]+/, $PREF{minutes_at_which_to_check});

	if(($PREF{check_daily_for_old_files} =~ /yes/i && $hours_at_which_to_check{$current_hour})   ||   ($PREF{check_hourly_for_old_files} =~ /yes/i && $minutes_at_which_to_check{$current_minute}))
	{
		if($PREF{automatically_delete_old_uploads} =~ /yes/i)
		{
			delete_files_and_folders_older_than($PREF{max_age_for_uploads}, $PREF{uploaded_files_realpath});
		}
		if($PREF{automatically_delete_old_humantest_images} =~ /yes/i)
		{
			delete_files_and_folders_older_than($PREF{max_age_for_humantest_images}, "$PREF{human_test_image_directory___real}");
		}
		if($PREF{automatically_delete_old_logfiles} =~ /yes/i)
		{
			delete_files_and_folders_older_than($PREF{max_age_for_logfiles}, $PREF{datadir}, '.+\.fctemp\.\w{1,5}$');
			delete_files_and_folders_older_than($PREF{max_age_for_logfiles}, $PREF{datadir}, '.+\.rawpost$');
			delete_files_and_folders_older_than($PREF{max_age_for_logfiles}, $PREF{datadir}, '/CGItemp\d+$');
			delete_files_and_folders_older_than($PREF{max_age_for_logfiles}, $PREF{datadir}, '/magic\w+$');
		}
		if($PREF{automatically_delete_old_multidownload_zip_files} =~ /yes/i)
		{
			# Note: regex ends with (/|$) because the slash will match filenames, not just foldernames, and
			# the folder (ending with the dollar-sign) will never get deleted until the files inside do.
			delete_files_and_folders_older_than($PREF{max_age_for_multidownload_zip_files}, $PREF{uploaded_files_realpath}, '.+\.fczipsub(/|$)');
		}
	}
}


sub info_system_is_enabled
{
	return $PREF{store_upload_info_in_database} =~ /yes/i;
}


sub start_html_output
{
	start_html_output_std(@_);
}


sub finish_html_output
{
	finish_html_output_std(@_);
}


sub get_linkbar
{
	my $home_link		= qq`<a href="$PREF{home_link_url}">$PREF{home_link_name}</a>`;
	my $uploader_link	= qq`<a href="$PREF{here_uploader}` . make_qs($PREF{here_uploader}, 'uploader') . qq`">$PREF{upload_files_link_label}</a>`;
	my $filelist_link	= qq`<a href="$PREF{here_filelist_qsready}action=listfiles$PREF{default_url_vars}">$PREF{show_uploads_link_text}</a>`;
	my $administration_link	= qq`<a href="$PREF{here_qsready}action=administration">$PREF{administration_link_name}</a>`;
	my $altuploadlog_link	= qq`<a href="$PREF{here_qsready}action=altuploadlog">$PREF{alternate_upload_log_footer_link_name}</a>`;

	@_ = ('home', 'uploader', 'list', 'administration', 'altuploadlog', 'myaccount', 'login', 'logout') unless @_;

	my @links = ();
	while(my $i = shift)
	{
		   if($i =~ /uploader/)		{ push (@links, $uploader_link) if $PREF{upload_files_link_label} && user_is_allowed_to('upload') && $PREF{on_page} ne 'uploader'; }

		elsif($i =~ /home/)		{ push (@links, $home_link) if $PREF{home_link_name}; }

		elsif($i =~ /mkdir/)		{ if($PREF{enable_subdirs} =~ /yes/i) { push @links, qq`<a href="$PREF{here_filelist_qsready}action=$PREF{mkdir_action_name}` . ($qs =~ /(?:^|&)path=(.+?)(?:&|$)/ ? "&amp;path=$1" : '') . ($PREF{default_url_vars}) . qq`">$TEXT{New_Folder}</a>` if display_new_folder_link(); } }

		elsif($i =~ /selections/)	{ push @links, qq`<a href="$PREF{here_filelist_qsready}action=view_items$PREF{default_url_vars}">$PREF{view_items_page_name}</a>` if display_showcart_link_in_linkbar(); }

		elsif($i =~ /myaccount/)	{ push (@links, qq`<a href="` . get_login_url()  . qq`">$TEXT{My_Account}</a>`) if $PREF{member_is_logged_in} && $PREF{show_myaccount_link} =~ /yes/i && ($PREF{integrate_with_userbase} =~ /yes/i || $PREF{integrate_with_userbase_method_b} =~ /yes/i); }

		elsif($i =~ /logout/)		{ push (@links, qq`<a href="` . get_logout_url() . qq`">$TEXT{Logout}</a>`) if $PREF{show_login_link} =~ /yes/i && $PREF{member_is_logged_in}; }

		elsif($i =~ /login/)		{ push (@links, qq`<a href="` . get_login_url()  . qq`">$TEXT{Login}</a>`)  if $PREF{show_login_link} =~ /yes/i && !$PREF{member_is_logged_in}; }

		elsif($i =~ /list/)		{ push (@links, $filelist_link) if ($PREF{show_uploads_link_text} && show_link_to_filelist()); }

		elsif($i =~ /addfile/)		{ push (@links, qq`<a href="$PREF{here_uploader}` . make_qs($PREF{here_uploader}, 'uploader', 'addfile') . qq`">$PREF{label_for_addfile_action}</a>`) if ($PREF{enable_addfile_mode} =~ /yes/i); }

		elsif($i =~ /administration/)	{ push (@links, $administration_link) if user_is_allowed_to('view_administration_page') && $PREF{administration_link_name}; }
		
		elsif($i =~ /altuploadlog/)	{ push (@links, $altuploadlog_link) if !user_is_allowed_to('view_upload_log_db')   &&   $PREF{groups_allowed_to_edit_alt_upload_log_db} =~ /(^|,)\s*self\s*(,|$)/   &&   $PREF{store_upload_info_in_database} =~ /yes/i   &&   $PREF{member_is_logged_in}   &&   $PREF{logged_in_username}; }
	}

	if(!@links)
	{
		push (@links, $home_link) if $PREF{home_link_name};

		push (@links, $uploader_link) if ($PREF{upload_files_link_label} && user_is_allowed_to('upload'));

		push (@links, $filelist_link) if ($PREF{show_uploads_link_text} && show_link_to_filelist());
	}

	push (@links, @{$PREF{extra_footer_links}}) if $PREF{extra_footer_links};
	push (@links, get_powered_by()) unless $PREF{hide_poweredby} =~ /yes/i;

	   if($PREF{on_page} eq 'uploader'		&& exists $PREF{custom_footer_for_uploader})			{ return $PREF{custom_footer_for_uploader};		}
	elsif($PREF{on_page} eq 'popupstatus'		&& exists $PREF{custom_footer_for_popupstatus})			{ return $PREF{custom_footer_for_popupstatus};		}
	elsif($PREF{on_page} eq 'uploadcomplete'	&& exists $PREF{custom_footer_for_uploadcomplete})		{ return $PREF{custom_footer_for_uploadcomplete};	}
	elsif($PREF{on_page} eq 'filelist'		&& exists $PREF{custom_footer_for_filelist})			{ return $PREF{custom_footer_for_filelist};		}
	elsif($PREF{on_page} eq 'default'		&& exists $PREF{custom_footer_for_default})			{ return $PREF{custom_footer_for_default};		}
	else														{ return join " &#8211; ", @links;			}
}


sub print_powered_by
{
	print	  qq`<div id="pb">\n`;
	print get_powered_by();
	print	  qq`</div>\n`;
}


sub get_powered_by
{
	return qq`<a href="http://www.schobuk.com/" target="_blank">Home</a>`;
}


sub display_new_folder_link()
{
	return user_is_allowed_to('create_folders_thru_filelist') && user_can_write_to_at_least_one_directory();
}


sub user_can_write_to_at_least_one_directory()
{
	return
	(
			$PREF{admin_is_logged_in}
		||
			($PREF{userdir}   &&   $PREF{assume_userdir_means_a_writable_dir_exists} !~ /no/i)
		||
			get_all_writable_directories()
	);
}


sub make_qs
{
	my $base	= shift;
	my $newqs	= '';
	my @items	= ();
	foreach my $arg (@_)
	{
		if($arg eq 'uploader')
		{
			if($PREF{default_page} ne 'uploader')
			{
				push @items, 'action=upload';
			}

			# TODO: this is a good feature but doesn't work in all situations, i.e.
			# needs to be tested with and without subdir drop-down, with and without
			# auto-created new folders, etc.
			# Update 201104: trying this again.  One change is that we should never
			# include $PREF{uploaded_files_urlpath} on it, since that's just redundant.
			# Update 201112: one problem: navigate_users_into_userdirs_automatically
			# means ?path isn't set, so we'll set it to '/' here -- which will then
			# result in a permissions error at the *end* of the upload.  Might be an
			# easy workaround for that, but for now, we'll just disable the path=foo
			# in that case.
			#
			my $curdir = get_qs_var('path') || '/';
			#encdebug "curdir=$curdir";
			#$curdir = "$PREF{uploaded_files_urlpath}/$curdir" unless $PREF{hide_path_to_uploads_dir} =~ /yes/i;
			slashify($curdir);
			#encdebug "curdir=$curdir (after slashifying)";
			push (@items, "path=$curdir") unless $PREF{navigate_users_into_userdirs_automatically} =~ /yes/i;
		}
		elsif($arg eq 'addfile')
		{
			my ($path) = ($qs =~ /(?:^|&)path=(.*?)(?:&|$)/);
			$path = '/' unless $path;
			push @items, "addfilemode=on&path=$path";
		}
	}

	push (@items, $PREF{default_url_vars}) if $PREF{default_url_vars};

	if(@items)
	{
		for(@items)
		{
			$newqs .= $_ . '&';
		}
		$newqs =~ s/&$//;

		$newqs = $base =~ /\?/ ? "&$newqs" : "?$newqs";
	}

	return $newqs;
}


sub get_origref()
{
	# Return the URL of the current page, but in an encoded form that can be passed on another URL.

	my $origref = $PREF{REQ_URI_SANS_QS};
	if($qs)
	{
		$origref .= '__OQM__';
		my $origref_qs = $qs;
		$origref_qs =~ s!&!__OAMP__!g;
		$origref .= $origref_qs;
	}
	return $origref;
}


sub decode_origref()
{
	my $origref = get_qs_var('origref');
	$origref =~ s!__OQM__!?!g;
	$origref =~ s!__OAMP__!&!g;
	return $origref;
}


sub get_view_menu
{
	return unless $PREF{enable_view_menu} =~ /yes/i;

	my $pos = shift;

	# action=itemactions

	my $form =	  qq``
			#. qq`<form method="get" action="$ENV{SCRIPT_NAME}" id="options$pos">`
			#. qq`\n<input type="hidden" name="action" value="setoption" />`
			. qq`\n<select name="selopt">`
			. qq`\n<option value="">$TEXT{view_menu_label}</option>`
			. qq`\n`;

	if($PREF{enable_multiple_filelist_modes} =~ /yes/i)
	{
		$form .=	  qq`\n<optgroup label="$TEXT{Layout_}">`
				. qq`\n<option value="fclistmode-list">$TEXT{list}` . ($PREF{current_filelist_mode} =~ /^list$/i ? ' *' : '') . qq`</option>`
				. qq`\n<option value="fclistmode-grid">$TEXT{grid}` . ($PREF{current_filelist_mode} =~ /^grid$/i ? ' *' : '') . qq`</option>`
				. qq`\n</optgroup>`
				. qq`\n`;
	}


	if($PREF{enable_app_style_switcher} =~ /yes/i)
	{
		$form .=	  qq`\n<optgroup label="$TEXT{Styles_}">`;
		foreach my $style (split(/[, ]+/, $PREF{enabled_styles}))
		{
			$form .=  qq`\n<option value="fcliststyle-$style">$style` . ($style eq get_current_app_style() ? ' *' : '') . qq`</option>`;
		}
		$form .=	  qq`\n</optgroup>`;
	}


	if(image_thumbnails_possible() && $PREF{visitors_can_toggle_thumbnails_on_and_off} =~ /yes/i)
	{
		if($PREF{enable_file_thumbnails_in_filelist} =~ /yes/i)
		{
			$form .=	  qq`\n<optgroup label="$TEXT{Image_Thumbs_}">`
					. qq`\n<option value="filethumbs-on">$TEXT{on}` . (file_thumbnails_enabled() ? ' *' : '') . qq`</option>`
					. qq`\n<option value="filethumbs-off">$TEXT{off}` . (file_thumbnails_enabled() ? '' : ' *') . qq`</option>`
					. qq`\n</optgroup>`
					. qq`\n`;
		}

		if($PREF{enable_folder_thumbnails_in_filelist} =~ /yes/i)
		{
			$form .=	  qq`\n<optgroup label="$TEXT{Folder_Thumbs_}">`
					. qq`\n<option value="folderthumbs-on">$TEXT{on}` . (folder_thumbnails_enabled() ? ' *' : '') . qq`</option>`
					. qq`\n<option value="folderthumbs-off">$TEXT{off}` . (folder_thumbnails_enabled() ? '' : ' *') . qq`</option>`
					. qq`\n</optgroup>`
					. qq`\n`;
		}

		if($PREF{enable_video_thumbnails_in_filelist} =~ /yes/i)
		{
			$form .=	  qq`\n<optgroup label="$TEXT{Video_Thumbs_}">`
					. qq`\n<option value="videothumbs-on">$TEXT{on}` . (video_thumbnails_enabled() ? ' *' : '') . qq`</option>`
					. qq`\n<option value="videothumbs-off">$TEXT{off}` . (video_thumbnails_enabled() ? '' : ' *') . qq`</option>`
					. qq`\n</optgroup>`
					. qq`\n`;
		}
	}

	$form .=	  qq`\n</select>`
			. qq`\n<input type="submit" value="$TEXT{Apply}" onclick="document.getElementById('itemactions').submit()" id="optionssubmit$pos" class="default button submit" />`
			#. qq`\n</form>`
			. qq`\n`;
}


sub show_files_as_links_on_upload_complete_page
{
	return user_is_allowed_to('download');
}


sub make_dir
{
	my $path = get_qs_var('path');
	my $dirname = get_qs_var('dirname');

	unless(user_is_allowed_to('create_folders_thru_filelist'))
	{
		#print_not_allowed_error_and_exit();
		exit_with_access_denied();
	}

	$path = enc_untaint($path, 'keep_path') if $path;
	$dirname = enc_untaint($dirname) if $dirname;
	clean_up_filename($dirname) if $PREF{clean_up_foldernames} =~ /yes/i;

	if($path && $dirname)
	{
		exit_with_error("Insufficient permissions on target folder.") unless folder_perms_allow_reading_and_writing($path);

		my $num_subdir_levels = 0;
		my $testpath = "/$path";
		while($testpath =~ m!(/|\\)[^/\\]+!g)
		{
			$num_subdir_levels++;
		}

		if(   ($PREF{max_num_of_subdir_levels} !~ /^\d+$/)   ||   ($num_subdir_levels < $PREF{max_num_of_subdir_levels})   )
		{
			my $maxlen = $PREF{max_length_of_new_subdir_names};
			$dirname =~ s/^(.{1,$maxlen}).*/$1/;

			my $fullpath_url  = $PREF{hide_path_to_uploads_dir} =~ /yes/i ? "/$path/$dirname" : $PREF{uploaded_files_urlpath} . "/$path/$dirname";
			my $fullpath_real = $PREF{uploaded_files_realpath} . "/$path/$dirname";
			my $path_urlencoded = "$path/$dirname";
			s![/\\]{2,}!/!g for ($fullpath_url, $fullpath_real, $path_urlencoded);

			enc_urlencode($path_urlencoded);
			my $userdir = get_userdir_for_qs();

			# A lame superfluous test, needed on some 1&1 servers (DD).
			#
			if(-e $fullpath_real)
			{
				start_html_output('New Folder');

				print	  qq`<h3>Folder Exists</h3>`
					. qq`\n<p>Folder <a href="$PREF{here_filelist_qsready}action=listfiles&${userdir}path=$path_urlencoded">$fullpath_url</a> exists.</p>`
					. qq`\n`;

				finish_html_output();
			}
			else
			{
				if(mkdir($fullpath_real,$PREF{writable_dir_perms})   &&   chmod($PREF{writable_dir_perms},$fullpath_real))
				{
					start_html_output('Creating...');

					print	  qq`<h3>New Folder Created Successfully:</h3>`
						. qq`\n<p><a href="$PREF{here_filelist_qsready}action=listfiles&${userdir}path=$path_urlencoded">$fullpath_url</a></p>`
						. qq`\n`;

					finish_html_output();
				}
				else
				{
					die_nice(qq`Error: couldn't create directory "$fullpath_url": $!`);
				}
			}
		}
		else
		{
			die_nice(qq`Error: couldn't create directory: sublevel limit ($num_subdir_levels) would be exceeded.`);
		}
	}
	else
	{
		my $hidden_userdir_input  = $PREF{enable_userdir_on_url} =~ /yes/i && $PREF{keep_userdir_on_url} =~ /yes/i ? qq`<input type="hidden" name="userdir" value="$PREF{userdir}" />` : '';
		   $hidden_userdir_input .= $PREF{enable_userdir_on_url} =~ /yes/i && $PREF{keep_userdir_on_url} =~ /yes/i && $PREF{allow_userdir_on_url_insecurely} !~ /yes/i ? qq`<input type="hidden" name="userdirhash" value="` . (get_qs_var('userdirhash')) . qq`" />` : '';

		start_html_output('Make New Directory');

		print	  qq`<h3>Location:</h3>`
			. qq`\n<form method="get" action="$PREF{here_filelist}">`
			. qq`\n` . $hidden_userdir_input
			. qq`\n<br /><input type="hidden" name="action" value="$PREF{mkdir_action_name}" />`
			. qq`\n<select name="path">`
			;

		#print	  qq`\n<option value="/">` . (get_uploaded_files_url_path('without_trailing_slash')) . qq`/</option>`;
		foreach my $dir (get_all_writable_directories())
		{
			slashify($dir);
			next if item_is_hidden($dir);
			print	  qq`\n<option value="$dir"` . ($dir eq "$path" ? qq` selected="selected"` : '') . qq`>` . get_uploaded_files_url_path('without_trailing_slash') . qq`$dir</option>`;
		}

		print	  qq`\n</select>`
			. qq`\n<br /><br /><h3>Name:</h3>`
			. qq`\n<br /><input type="text" name="dirname" class="default text" />`
			. qq`\n<br /><br /><br /><input type="submit" value="Create It" class="default button submit" />`
			. qq`\n</form>`
			. qq`\n`;

		finish_html_output();
		
	}
}


sub download_multiple_items($)
{
	my $query = new CGI(); # must happen, or there's a weird delay between client/server after the script finishes.
	my %params = $query->Vars;

	exit_with_access_denied() unless user_is_allowed_to('download');

	my $path = shift || '/';
	enc_urldecode($path);
	$path = enc_untaint($path, 'keep_path') if $path;
	slashify($path);

	my $input_dir = "$PREF{uploaded_files_realpath}/$path";
	condense_slashes('leave_leading_UNC', $input_dir);
	enc_chdir($input_dir);

	my @items = ();
	my @errors = ();
	my $some_successful_additions = 0;

	foreach my $param(sort keys %params)
	{
		if(my ($itemtype,$filename) = ($param =~ /^(file|dir)-(.+)/))
		{
			$itemtype = 'folder' if $itemtype eq 'dir';
			enc_urldecode($filename);
			$filename = enc_untaint($filename) if $filename;
			#my $diskitem = "$PREF{uploaded_files_realpath}/$path/$filename";
			#condense_slashes('leave_leading_UNC', $diskitem);
			#
			# If we chdir'ed into the input directory (above), then we don't need to specify paths here.
			#
			my $diskitem = $filename;

			if(!-e $diskitem)
			{
				push @errors, qq`The $itemtype '$filename' doesn't exist in this location.`;
			}
			elsif(!-r $diskitem)
			{
				push @errors, qq`The $itemtype '$filename' is not readable.`;
			}
			else
			{
				$some_successful_additions = 1;
				push @items, qq`"$diskitem"`;
			}
		}
	}

	my $hash = enc_hash($ENV{HTTP_USER_AGENT} . $$ . offsettime() . $PREF{ip} . $ENV{REMOTE_PORT} . rand());
	my ($output_dir_local,$output_dir_real,$path_is_absolute) = ('','',0);

	#if($PREF{multidownload_output_directory})
	#
	# TODO: maybe support manually specifying a single output directory, rather than using
	# a subdir within each folder; but this requires relatively extensive changes to other
	# functions too.  If/when this is implemented, add the following to the prefs file:
	#
	#	$PREF{multidownload_output_directory} = ''; # should be null in most cases, to use a subdir in the source dir.
	#
	if(0)
	{
		$path_is_absolute	= 1;
		$output_dir_local	= "$hash.fczipsub";
		$output_dir_real	= "$PREF{multidownload_output_directory}/$output_dir_local";
	}
	else
	{
		$output_dir_local	= "$path/$PREF{name_of_subfolder_for_thumbnails_etc}/$PREF{folder_name_for_working_with_zip_files}/$hash.fczipsub";
		$output_dir_real	= "$PREF{uploaded_files_realpath}/$output_dir_local";
	}
	condense_slashes('leave_leading_UNC', $output_dir_local);
	condense_slashes('leave_leading_UNC', $output_dir_real);
	create_dir_if_DNE($output_dir_real, $PREF{writable_dir_perms}, 'make_parents');

	my $output_filename = $PREF{multidownload_output_filename_template};
	$output_filename .= '.zip' unless $output_filename =~ /\.zip$/i;

	#my $cmd = qq`zip "$output_dir_real/$output_filename" "` . (join '" "', @items) . qq`"`;
	my $cmd = $PREF{multidownload_command_template};
	# Note: the zip command must include the "-q" switch on Windows servers, otherwise Windows barfs the STDOUT into the server.
	$cmd =~ s!%%output_filename%%!"$output_dir_real/$output_filename"!g;
	$cmd =~ s!%%input_file_list%%!join ' ', @items!eg;

	#print STDERR "zip command is: $cmd\n";
	my ($success,$zip_error) = enc_sys_call($cmd);
	exit_with_error(qq`Error: output file does not exist after trying to create it: <br /><br />\nOutput file: $output_dir_real/$output_filename<br /><br />\nCommand execution success: $success<br /><br />\nZip error: $zip_error<br /><br />\nMake sure there is a "zip" command on your server.&nbsp; For Windows servers you may need to download a zip.exe application, such as the one from <a href="http://www.info-zip.org/" target="_blank">Info-ZIP</a> or <a href="http://www.7-zip.org/" target="_blank">7-Zip</a>.`) unless -f "$output_dir_real/$output_filename";
	#print STDERR "output file size: " . (-s "$output_dir_real/$output_filename") / (1024*1024) . " MB\n\n";

	if(@errors || !$success)
	{
		my $go = $ENV{HTTP_REFERER} || "$PREF{here_filelist_qsready}action=listfiles";
		my $error_message = '';
		if(@errors)
		{
			$error_message = $some_successful_additions ? qq`<p>Some items were added to the zip file successfully, but the following error(s) occurred:</p>` : qq`<p>Could not create zip file for multi-item download; the following error(s) occurred:</p>`;
			$error_message .= "<p>" . (join "<br /><br />", @errors) . qq`</p>`;
		}
		if(!$success)
		{
			$error_message .= qq`<p>The following error occurred while running the zip command: $zip_error</p>`;
		}

		$error_message .= qq`<p>Click the link below to download the file anyway, or you can <a href="$go">return to the previous page</a>.</p>`;

		show_download_landing_page($output_dir_local, $output_filename, $error_message);
	}
	elsif($PREF{file_links_on_download_page_go_to} eq 'landing_page')
	{
		show_download_landing_page($output_dir_local, $output_filename);
	}
	else
	{
		download_file( { passed_path => $output_dir_local, passed_file => $output_filename });
		#download_file({ passed_path => $output_dir_local, passed_file => $output_filename, path_is_absolute => 1 });
	}
}


sub copy_items($)
{
	my $query = new CGI(); # must happen, or there's a weird delay between client/server after the script finishes.
	my %params = $query->Vars;

	exit_with_access_denied() unless user_is_allowed_to('copy_items');

	my ($path) = @_; enc_urldecode($path);
	my $source_dir_url	= "$PREF{uploaded_files_urlpath}/$path";
	my $source_dir_real	= "$PREF{uploaded_files_realpath}/$path";
	my $dest_dir_local	= param('copymovedest');
	my $dest_dir_url	= "$PREF{uploaded_files_urlpath}/$dest_dir_local";
	my $dest_dir_real	= "$PREF{uploaded_files_realpath}/$dest_dir_local";
	condense_slashes('leave_leading_UNC', $source_dir_real, $dest_dir_real);
	condense_slashes($source_dir_url, $dest_dir_url);

	my (@successes,@errors) = ();

	foreach my $param(sort keys %params)
	{
		if(my ($itemtype,$itemname) = ($param =~ /^(file|dir)-(.+)/))
		{
			enc_urldecode($itemname);
			my $source_item_url	= "$source_dir_url/$itemname";
			my $source_item_real	= "$source_dir_real/$itemname";
			my $dest_item_url	= "$dest_dir_url/$itemname";
			my $dest_item_real	= "$dest_dir_real/$itemname";
			condense_slashes('leave_leading_UNC', $source_item_real, $dest_item_real);
			condense_slashes($source_item_url, $dest_item_url);

			if($itemtype eq 'dir')
			{
				#encdebug "Copying dir '$itemname' from '$source_item_real' to '$dest_item_real'.";
				create_dir_if_DNE($dest_item_real, $PREF{writable_dir_perms}, 'make_parents', 'ignore_errors');
				my($successes_local, $errors_local) = mirror_dir_tree_and_contents($source_item_real, $dest_item_real);
				for(@$successes_local)
				{
					push @successes, "$itemname: $_";
				}
				for(@$errors_local)
				{
					push @errors, "$itemname: $_";
				}
			}
			else
			{
				#encdebug, "Copying file '$itemname' from '$source_item_real' to '$dest_item_real'.";
				if(copy($source_item_real, $dest_item_real))
				{
					push @successes, $itemname;
				}
				else
				{
					push @errors, "$itemname: $!";
				}
			}
		}
	}

	my $go = "$PREF{here_filelist_qsready}action=listfiles&path=$dest_dir_local";
	if(@errors)
	{
		my $output = @successes ? qq`<p>There were some successful copies, but the following error(s) occurred:</p>` : qq`<p>There were no successful copies; the following error(s) occurred:</p>`;
		$output .= "<p>" . (join "<br /><br />", @errors) . qq`</p><p>[ <a href="$go">OK</a> ]</p>`;
		exit_with_error($output);
	}
	else { enc_redirect($go); }
}


sub delete_items($)
{
	my $query = new CGI(); # must happen, or there's a weird delay between client/server after the script finishes.
	my %params = $query->Vars;

	exit_with_access_denied() unless user_is_allowed_to('delete_items');

	my ($path) = @_;
	enc_urldecode($path);
	my @errors = ();
	my $some_successful_deletions = 0;

	foreach my $param(sort keys %params)
	{
		if(my ($itemtype,$filename) = ($param =~ /^(file|dir)-(.+)/))
		{
			$itemtype = 'folder' if $itemtype eq 'dir';
			enc_urldecode($filename);
			if(my $error = delete_item($path, $itemtype, $filename, 'batchmode'))
			{
				push @errors, qq`Error while deleting $itemtype $filename: $error`;
			}
			else { $some_successful_deletions = 1; }
		}
	}

	my $go = $ENV{HTTP_REFERER} || "$PREF{here_filelist_qsready}action=listfiles";
	if(@errors)
	{
		my $output = $some_successful_deletions ? qq`<p>There were some successful deletions, but the following error(s) occurred:</p>` : qq`<p>There were no successful deletions; the following error(s) occurred:</p>`;
		$output .= "<p>" . (join "<br /><br />", @errors) . qq`</p><p>[ <a href="$go">OK</a> ]</p>`;
		exit_with_error($output);
	}
	else { enc_redirect($go); }
}


# This sub must return null on success, or an error message on error.
#
sub delete_item
{
	my $path = shift;
	my $itemtype = shift; # 'file' or 'folder'.
	my $name = shift;
	my $batchmode = shift;

	exit_with_access_denied() unless user_is_allowed_to('delete_items');

	enc_urldecode($path, $name);
	$name = enc_untaint($name) if $name;
	$path = enc_untaint($path, 'keep_path') if $path;

	my $displayname = $name;
	if($displayname =~ /(\d{15,})(\..{1,6})$/)
	{
		my ($to_replace,$end) = ($1,$2);
		my ($replacement) = ($to_replace =~ /^(\d{12})/);
		$displayname =~ s/$to_replace$end/$replacement...$end/;
	}

	my $diskitem_parent = "$PREF{uploaded_files_realpath}/$path";
	my $diskitem = "$PREF{uploaded_files_realpath}/$path/$name";
	my $siteitem = "$PREF{uploaded_files_urlpath}/$path/$name";
	s![/\\]{2,}!/!g for ($diskitem_parent, $diskitem, $siteitem);

	if($itemtype eq 'folder')
	{
		return "Insufficient privileges on the parent folder."	unless folder_perms_allow_reading_and_writing($path);
		return "Insufficient privileges on the folder."		unless folder_perms_allow_reading_and_writing("$path/$name");

		foreach my $folder (get_all_subdirs($diskitem))
		{
			$folder = "$path/$name/$folder";
			return "Insufficient privileges on the folder contents." unless folder_perms_allow_reading_and_writing($folder);
		}
	}
	elsif($itemtype eq 'file')
	{
		return "Insufficient privileges on the parent folder." unless folder_perms_allow_reading_and_writing($path);
	}
	else
	{
		return "Invalid itemtype '$itemtype'.";
	}

	if($itemtype eq 'file')
	{
		return "The specified file does not exist." unless -e $diskitem;
		unless(my $success = unlink($diskitem))
		{
			return "Warning: could not delete '$diskitem'.&nbsp; The file may simply be in use by another application, so try again later.&nbsp; If the problem persists, there may be a permissions error.&nbsp; (Error was: '$!'.)";
		}

		my $thumb = "$PREF{uploaded_files_realpath}/$path/$PREF{filelist_thumbnail_dir_name}/$name";
		$thumb = get_video_thumb_filename($thumb) if is_video($name);
		condense_slashes('leave_leading_UNC', $thumb);
		unlink($thumb) if -f $thumb;

		delete_related_database_items($path,$name);
	}
	else
	{
		delete_directory($diskitem);
	}

	if($batchmode)
	{
		return '';
	}
	else
	{
		my $new_qs = get_path_and_userdir_for_qs();
		my $go = $ENV{HTTP_REFERER} ? $ENV{HTTP_REFERER} : qq`$PREF{here_filelist_qsready}action=listfiles` . ($new_qs ? "&$new_qs" : '');
		enc_redirect($go);
	}
}


sub delete_related_database_items
{
	my ($path,$name) = @_;

	if($PREF{store_upload_info_in_database} =~ /yes/i)
	{
		sql_untaint($name,$path);
		replace_nonsqlsafe_chars_with('_', $name, $path);
		die_unless_sqlsafe($name,$path);
		$path = '/' unless $path;
		if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{upload_log_table}` WHERE `filename`='$name' AND `filepath`='$path'"))
		{
			enc_sql_delete("DELETE FROM `$PREF{upload_log_table}` WHERE `filename`='$name' AND `filepath`='$path' LIMIT 1");
		}
	}

	# TODO: add blocks for deleting from other DB tables here.
}


sub move_item
{
	my $action = shift;	# action is move or rename.
	my $itemtype = shift;	# type is 'file' or 'folder'.
	my $item = shift;	# item is the filename or foldername, without any path.
	my $src = shift;	# src is the folder that the item is currently in.
	my $dst = shift || '';	# dst is either the folder we're moving the item into (for moves), or the new name we're giving the item (for renames).

	unless(user_is_allowed_to('move_items'))
	{
		#print_not_allowed_error_and_exit();
		exit_with_access_denied();
	}

	enc_urldecode($item, $src, $dst);

	$item = enc_untaint($item);
	$src = enc_untaint($src, 'keep_path') if $src;

	exit_with_error("Insufficient privileges on directory to be moved.") if ($itemtype eq 'folder'   &&   !folder_perms_allow_reading_and_writing("$src/$item"));
	exit_with_error("Insufficient privileges on source directory.") unless folder_perms_allow_reading_and_writing($src);

	if($action =~ /move/)
	{
		if($dst) # otherwise we're in stage 1 of the move operation and the dest hasn't been chosen yet.
		{
			$dst = enc_untaint($dst, 'keep_path');
			exit_with_error("Insufficient privileges on destination directory.") unless folder_perms_allow_reading_and_writing($dst);
		}
	}
	else # rename, so $dst is a filename/foldername with no path.
	{
		if($itemtype eq 'file')
		{
			exit_with_error($TEXT{Error_illegal_filename_}) if filename_is_illegal($dst);
		}
		$dst = enc_untaint($dst) if $dst;
		clean_up_filename($dst) if $itemtype eq 'file'   && $PREF{clean_up_filenames} =~ /yes/i;
		clean_up_filename($dst) if $itemtype eq 'folder' && $PREF{clean_up_foldernames} =~ /yes/i;
	}


	# Note: here "local" means just like "url" except without $PREF{uploaded_files_urlpath} on the front.
	my ($localsrc, $localdst, $urlsrc, $urldst, $fullsrc, $fulldst, $fullitem_src, $fullitem_dst, $urlitem_src, $urlitem_dst, $localitem_src, $localitem_dst) = ();
		$localsrc	= '/' . $src;

		$urlsrc		= $PREF{uploaded_files_urlpath} . $localsrc;
		$urlitem_src	= $PREF{uploaded_files_urlpath} . $localsrc . '/' . $item;

		$fullsrc	= $PREF{uploaded_files_realpath} . $localsrc;
		$fullitem_src	= $PREF{uploaded_files_realpath} . $localsrc . '/' . $item;

		# This is unused?
		#$localitem_src	= $localsrc . '/' . $item;

	if($action =~ /move/)
	{
		$localdst	= '/' . $dst;

		$urldst		= $PREF{uploaded_files_urlpath} . $localdst;
		$urlitem_dst	= $PREF{uploaded_files_urlpath} . $localdst . '/' . $item;

		$fulldst	= $PREF{uploaded_files_realpath} . $localdst;
		$fullitem_dst	= $PREF{uploaded_files_realpath} . $localdst . '/' . $item;

		# This is unused?
		#$localitem_dst	= $localdst . '/' . $item;
	}
	else # rename.  here, $dst is just a filename or foldername with no path -- the path for dst is the same as the src path.
	{
		$localdst	= $localsrc;

		$urldst		= $urlsrc;
		$urlitem_dst	= $urlsrc . '/' . $dst;

		$fulldst	= $fullsrc;
		$fullitem_dst	= $fullsrc . '/' . $dst;

		# This is unused?
		#$localitem_dst	= $localdst . $dst;
	}
	s![/\\]{2,}!/!g for ($localsrc, $localdst, $urlsrc, $urldst, $fullsrc, $fulldst, $fullitem_src, $fullitem_dst, $urlitem_src, $urlitem_dst);


	if(! -e $fullitem_src)
	{
		exit_with_error(qq`Error: $itemtype '$item' does not exist in $urlsrc.`);
	}
	elsif(($itemtype eq 'file' && ! -f $fullitem_src)   ||   ($itemtype eq 'folder' && ! -d $fullitem_src)   ||   ($itemtype !~ /^(file|folder)$/))
	{
		exit_with_error(qq`Error: specified item type does not match actual item type.`);
	}

	if($dst)
	{
		if($action eq 'rename'   &&   -f $fullitem_src   &&   ! -d $fullitem_src   &&   $dst !~ /.+\..+/   &&   $PREF{allow_files_without_extensions} !~ /yes/i)
		{
			# If the source is a normal file (not a directory) and the destination
			# filename doesn't have an extension, but they've enabled the extension
			# filters, then it's an error.

			exit_with_error(qq`Error: destination filename ("$dst") appears to have no extension.`);
		}
		elsif(-e $fullitem_dst)
		{
			exit_with_error(qq`Error: there is already a $itemtype named $item in $urldst.&nbsp; If you really want to overwrite it you must delete the existing $itemtype first.`);
		}
		else
		{
			my ($title, $output, $errormsg) = ();
			if($action =~ /copy/)
			{
				$title = "$TEXT{Copying}...";

				$output = 	  qq`<h3>$TEXT{Copied} $TEXT{$itemtype}:</h3>\n<p>$item</p>`
						. qq`<h3>$TEXT{From_}</h3>\n<p>$urlsrc</p>`
						. qq`<h3>$TEXT{To_}</h3>\n<p><a href="$PREF{here_filelist}?` . (get_userdir_for_qs()) . qq`action=listfiles&path=` . (enc_urlencode($dst) || 1 ? $dst : '') . qq`">$urldst</a></p>`
						. qq`\n\n`;

				$errormsg =	  qq`Error while trying to copy $itemtype "$item" from $urlsrc to $urldst: `;
			}
			elsif($action =~ /move/)
			{
				$title = "$TEXT{Moving}...";

				$output = 	  qq`<h3>$TEXT{Moved} $TEXT{$itemtype}:</h3>\n<p>$item</p>`
						. qq`<h3>$TEXT{From_}</h3>\n<p>$urlsrc</p>`
						. qq`<h3>$TEXT{To_}</h3>\n<p><a href="$PREF{here_filelist}?` . (get_userdir_for_qs()) . qq`action=listfiles&path=` . (enc_urlencode($dst) || 1 ? $dst : '') . qq`">$urldst</a></p>`
						. qq`\n\n`;

				$errormsg =	  qq`Error while trying to move $itemtype "$item" from $urlsrc to $urldst: `;
			}
			else
			{
				$title = "$TEXT{Renaming}...";

				$output =	  qq`<h3>$TEXT{Renamed} $TEXT{$itemtype}:</h3>\n<p>$item</p>`
						. qq`<h3>$TEXT{To_}</h3>\n<p>$dst</p>`
						. qq`<h3>$TEXT{In_}</h3>\n<p><a href="$PREF{here_filelist}?` . (get_userdir_for_qs()) . qq`action=listfiles&path=` . (enc_urlencode($src) || 1 ? $src : '') . qq`">$urlsrc</a></p>`
						. qq`\n\n`;

				$errormsg =	  qq`Error while trying to rename $itemtype "$item" to "$dst" in $urlsrc: `;
			}

			if($action =~ /copy/)
			{
				if(copy($fullitem_src, $fullitem_dst))
				{
					my $go = qq`$PREF{here_filelist}?` . (get_userdir_for_qs()) . qq`action=listfiles&path=$localsrc`;
					enc_redirect($go);
				}
				else
				{
					exit_with_error($errormsg . $!);
				}
			}
			else
			{
				if(rename($fullitem_src, $fullitem_dst))
				{
					my (@errors,$custom_folder_perms_errors,$file_and_dir_info_errors) = ();
					if($itemtype eq 'folder')
					{
						my ($old_dir_name) = ($fullitem_src =~ m!^$PREF{uploaded_files_realpath}(.*)!);
						my ($new_dir_name) = ($fullitem_dst =~ m!^$PREF{uploaded_files_realpath}(.*)!);
						$custom_folder_perms_errors = update_custom_folder_perms_for_dir($old_dir_name, $new_dir_name) if custom_folder_perms_enabled();

						slashify(my $oldpath = $old_dir_name);
						slashify(my $newpath = $new_dir_name);
						sql_untaint($newpath, $oldpath);
						if($PREF{store_upload_info_in_database} =~ /yes/i)
						{
							if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{upload_log_table}` WHERE `filepath`='$oldpath'"))
							{
								my $statement = "UPDATE `$PREF{upload_log_table}` SET filepath='$newpath' WHERE `filepath`='$oldpath'";
								my $success = enc_sql_update($statement);
								encdebug qq`Updated $success records in the upload_log_table, changing the filepath from '$oldpath' to '$newpath'.\n`;
								push(@errors, "SQL returned '$success' while updating filepath in the upload_log_table.  SQL was: [[$statement]]") unless $success =~ /^\d+$/;
							}
						}
						if($PREF{log_all_downloads} =~ /yes/i)
						{
							if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{download_log_table}` WHERE `path`='$oldpath'"))
							{
								my $statement = "UPDATE `$PREF{download_log_table}` SET path='$newpath' WHERE `path`='$oldpath'";
								my $success = enc_sql_update($statement);
								encdebug qq`Updated $success records in the download_log_table, changing the path from '$oldpath' to '$newpath'.\n`;
								push(@errors, "SQL returned '$success' while updating path in the download_log_table.  SQL was: [[$statement]]") unless $success =~ /^\d+$/;
							}
						}
						
						$file_and_dir_info_errors = update_file_and_dir_info_table($old_dir_name, $new_dir_name);
					}
					else
					{
						#print STDERR "localsrc=$localsrc, localdst=$localdst\n";
						slashify(my $oldpath = $localsrc);
						slashify(my $newpath = $localdst);
						my $oldfilename = $item;
						my $newfilename = $action =~ /move/ ? $item : $dst;
						sql_untaint($newpath, $newfilename, $oldpath, $oldfilename);
						if($PREF{store_upload_info_in_database} =~ /yes/i)
						{
							if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{upload_log_table}` WHERE `filepath`='$oldpath' AND `filename`='$oldfilename'"))
							{
								my $statement = "UPDATE `$PREF{upload_log_table}` SET filepath='$newpath',filename='$newfilename' WHERE `filepath`='$oldpath' AND `filename`='$oldfilename' LIMIT 1";
								my $success = enc_sql_update($statement);
								encdebug qq`Updated $success record(s) in the upload_log_table, changing the filepath from '$oldpath' to '$newpath', and the filename from '$oldfilename' to '$newfilename'.\n`;
								push(@errors, "SQL returned '$success' instead of '1' while updating filepath and filename in the upload_log_table.  SQL was: [[$statement]]") unless $success == 1;
							}
						}
						if($PREF{log_all_downloads} =~ /yes/i)
						{
							if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{download_log_table}` WHERE `path`='$oldpath' AND `file`='$oldfilename'"))
							{
								my $statement = "UPDATE `$PREF{download_log_table}` SET path='$newpath',file='$newfilename' WHERE `path`='$oldpath' AND `file`='$oldfilename' LIMIT 1";
								my $success = enc_sql_update($statement);
								encdebug qq`Updated $success record(s) in the download_log_table, changing the path from '$oldpath' to '$newpath', and the file from '$oldfilename' to '$newfilename'.\n`;
								push(@errors, "SQL returned '$success' instead of '1' while updating path and file in the download_log_table.  SQL was: [[$statement]]") unless $success == 1;
							}
						}
						
						$file_and_dir_info_errors = update_file_and_dir_info_table("$oldpath$oldfilename", "$newpath$newfilename");
					}

					start_html_output($title);
					print $output;
					if(@errors || $custom_folder_perms_errors || $file_and_dir_info_errors)
					{
						print	  qq`<p><br /><br />However, there were problems updating the metadata:</p>`
							. qq`\n<p>`
							. join("\n</p><p>", @errors)
							. qq`\n</p>`
							. qq`\n<p><br /><br />$custom_folder_perms_errors</p>\n`
							. qq`\n<p><br /><br />$file_and_dir_info_errors</p>\n`
							;
					}
					finish_html_output();
				}
				else
				{
					exit_with_error($errormsg . $!);
				}
			}
		}
	}
	else
	{
		my $hidden_userdir_input  = $PREF{enable_userdir_on_url} =~ /yes/i && $PREF{keep_userdir_on_url} =~ /yes/i ? qq`<input type="hidden" name="userdir" value="$PREF{userdir}" />` : '';
		   $hidden_userdir_input .= $PREF{enable_userdir_on_url} =~ /yes/i && $PREF{keep_userdir_on_url} =~ /yes/i && $PREF{allow_userdir_on_url_insecurely} !~ /yes/i ? qq`<input type="hidden" name="userdirhash" value="` . (get_qs_var('userdirhash')) . qq`" />` : '';

		#################
		### Move/Rename:
		#################

		if($action !~ /copy/)
		{
			start_html_output("Move/Rename $itemtype");

			print	  qq`<h1>$TEXT{Move} $TEXT{$itemtype}:</h1>\n<p>$item</p>`
				. qq`\n<h3>$TEXT{From_}</h3>\n<p>$urlsrc</p>`
				. qq`\n<h3>$TEXT{To_}</h3>`
				. qq`\n<form method="get" action="$PREF{here_filelist}">`
				. qq`\n` . $hidden_userdir_input
				. qq`\n<input type="hidden" name="action" value="move" />`
				. qq`\n<input type="hidden" name="$itemtype" value="$item" />`
				. qq`\n<input type="hidden" name="src" value="$src" />`
				. qq`\n<select name="dst">`
				;

			#print	  qq`\n<option value="/">` . (get_uploaded_files_url_path('without_trailing_slash')) . qq`/</option>`;
			foreach my $dir (get_all_writable_directories())
			{
				slashify($dir);
				next if item_is_hidden($dir);
				print	  qq`\n<option value="$dir">` . (get_uploaded_files_url_path('without_trailing_slash')) . qq`$dir</option>`;
			}

			print	  qq`\n</select>`
				. qq`\n<br /><br /><input type="submit" value="$TEXT{Move_It}" class="default button submit" />`
				. qq`\n</form>`
				. qq`\n`;

			print	  qq`\n<div class="hr"></div>`
				#. qq`\n<h1>$TEXT{Or_}</h1>`
				#. qq`\n<div class="hr"></div>`
				;

			print	  qq`\n<h1>$TEXT{Rename} $TEXT{$itemtype}:</h1>\n<p>$item</p>`
				. qq`\n<h3>$TEXT{To_}</h3>`
				. qq`\n<form method="get" action="$PREF{here_filelist}">`
				. qq`\n` . $hidden_userdir_input
				. qq`\n<input type="hidden" name="action" value="rename" />`
				. qq`\n<input type="hidden" name="$itemtype" value="$item" />`
				. qq`\n<input type="hidden" name="src" value="$src" />`
				. qq`\n<input type="text" name="dst" value="$item" class="default text" />`
				. qq`\n<br /><br /><input type="submit" value="$TEXT{Rename_It}" class="default button submit" />`
				. qq`\n<br /><br /></form>`
				. qq`\n`;
		}

		###########
		### Copy:
		###########

		if($itemtype eq 'file'   &&   $action =~ /copy/)
		{
			start_html_output("$TEXT{Copy} $itemtype");

			print	  qq`\n<div class="hr"></div>`
				#. qq`\n<h1>$TEXT{Or_}</h1>`
				#. qq`\n<div class="hr"></div>`
				;

			print	  qq`<h1>$TEXT{Copy} $TEXT{$itemtype} to new folder:</h1>\n<p>$item</p>`
				. qq`\n<h3>$TEXT{From_}</h3>\n<p>$urlsrc</p>`
				. qq`\n<h3>$TEXT{To_}</h3>`
				. qq`\n<form method="get" action="$ENV{SCRIPT_NAME}">`
				. qq`\n` . $hidden_userdir_input
				. qq`\n<input type="hidden" name="action" value="movecopy" />`
				. qq`\n<input type="hidden" name="$itemtype" value="$item" />`
				. qq`\n<input type="hidden" name="src" value="$src" />`
				. qq`\n<select name="dst">`
				;

			#print	  qq`\n<option value="/">` . (get_uploaded_files_url_path('without_trailing_slash')) . qq`/</option>`;
			foreach my $dir (get_all_writable_directories())
			{
				slashify($dir);
				next if item_is_hidden($dir);
				print	  qq`\n<option value="$dir">` . (get_uploaded_files_url_path('without_trailing_slash')) . qq`$dir</option>`;
			}

			print	  qq`\n</select>`
				. qq`\n<br /><br /><input type="submit" value="$TEXT{Copy_It}" class="default button submit" />`
				. qq`\n</form>`
				. qq`\n`;

			print	  qq`\n<div class="hr"></div>`
				#. qq`\n<h1>$TEXT{Or_}</h1>`
				#. qq`\n<div class="hr"></div>`
				;

			print	  qq`\n<h1>$TEXT{Copy} $TEXT{$itemtype} to new filename:</h1>\n<p>$item</p>`
				. qq`\n<h3>$TEXT{To_}</h3>`
				. qq`\n<form method="get" action="$ENV{SCRIPT_NAME}">`
				. qq`\n` . $hidden_userdir_input
				. qq`\n<input type="hidden" name="action" value="renamecopy" />`
				. qq`\n<input type="hidden" name="$itemtype" value="$item" />`
				. qq`\n<input type="hidden" name="src" value="$src" />`
				. qq`\n<input type="text" name="dst" value="$item" class="default text" />`
				. qq`\n<br /><br /><input type="submit" value="$TEXT{Copy_It}" class="default button submit" />`
				. qq`\n<br /><br /></form>`
				. qq`\n`;
		}

		finish_html_output();
	}
}


sub view_items
{
	my $selections = get_cookie($PREF{selection_cookie_name});
	my $i = 1;
	my @items = split(/:\|:\|:/, $selections);

	start_html_output($PREF{view_items_page_name});
	print $PREF{view_items_page_intro} . "\n";
	print qq`<table id="selections_table">\n`;
	foreach my $item (sort @items)
	{
		my ($path, $file) = ($item =~ m!(.*)/(.+)!);
		unless($file) { $file = $item; $path = (); }
		print qq`<tr class=` . ($i % 2 == 0 ? 'even' : 'odd') . qq`><td>$i: <a href="` . get_download_link('filelist_page', $path, $file) . qq`">$item</td></tr>\n`;
		$i++;
	}
	print qq`</table>\n`;

	print qq`<p style="font-style: italic;">(No items)</p>\n` unless $selections;

	if($selections)
	{
		print	  qq`<div id="place_order">`
			. qq`\n<form id="theorderform" method="get" action="$ENV{SCRIPT_NAME}">`
			. qq`\n<input type="hidden" name="action" value="process_order" />`
			. ($PREF{enable_userdirs} =~ /yes/i && $PREF{enable_userdir_on_url} =~ /yes/i ? qq`\n<input type="hidden" name="userdir" value=$PREF{userdir}" />` : undef)
			. qq`\n` . $PREF{place_order_fields}
			. qq`\n</form>`
			. qq`\n</div>`
			. qq`\n`;

		print qq`<p><a href="javascript:clear_selections()">$PREF{clear_selections_text}</a></p>\n`;
	}

	finish_html_output();
	
}


sub process_order
{
	my $selections = get_cookie($PREF{selection_cookie_name});
	die_nice(qq`Error: your cart is empty.`) unless $selections;
	my @items = split(/:\|:\|:/, $selections);

	my $user_info = ();
	my $user_email = ();
	for(split(/&/, $qs))
	{
		my ($name, $value) = split(/=/);
		next if $name eq 'action';
		enc_urldecode($name);
		enc_urldecode($value);
		$user_info .= qq`<p><b>$name</b>: $value</p>\n`;
		$user_email = $value if ($name =~ /e-?mail/i);
	}

	my $email_message =	  qq`<html>\n<body style="font-family: sans-serif;">`
				. qq`\n$PREF{order_email_top_intro}`
				. qq`\n$PREF{order_email_user_intro}`
				. qq`\n$user_info`
				. qq`\n$PREF{order_email_items_intro}`
				. qq`\n<table style="border: 1px solid #999; border-collapse: collapse;">\n`
				. qq`\n`;

	my $i = 1;
	foreach my $item (sort @items)
	{
		my ($path, $file) = ($item =~ m!(.*)/(.+)!);
		unless($file) { $file = $item; $path = (); }
		my $link = get_download_link('filelist_page', $path, $file);
		$link = "$PREF{protoprefix}$ENV{HTTP_HOST}$link" unless $link =~ m!^https?://!;
		$email_message .= qq`<tr style="background: ` . ($i % 2 == 0 ? '#fff' : '#efefef') . qq`;"><td style="padding: 4px;">$i: <a href="$link">$item</td></tr>\n`;
		$i++;
	}

	$email_message .= qq`</table>\n</body>\n</html>\n`;


	# send the email.
	my @recipients = ();
	foreach my $pref (sort keys %PREF)
	{
		if($pref =~ /^order_email_recipient_\d+$/)
		{
			push @recipients, $PREF{$pref};
		}
	}
	push (@recipients, $user_email) if $PREF{send_copy_to_userEntered_email_address} =~ /yes/i;

	for(@recipients)
	{
		die_nice(qq`Error: cannot continue because this email address is invalid: "$_".`) unless /.+\@.+\..+/;
	}
	for(@recipients)
	{
		send_email($_, $PREF{order_sender_email_address}, $PREF{order_email_subject}, $email_message, 'text/html', 'die_on_email_error');
	}


	# clear the user's cart and redirect to the confirmation page.
	set_cookie($PREF{selection_cookie_name}, undef);
	my $go = "$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_filelist_qsready}action=order_confirmation&items=$selections$PREF{default_url_vars}";
	enc_redirect($go);
}


sub order_confirmation
{
	my @items = ();
	if($qs =~ /(?:^|&)items=(.+?)(?:&|$)/)
	{
		my $selections = $1;
		enc_urldecode($selections);
		@items = split(/:\|:\|:/, $selections);
	}

	start_html_output($PREF{process_order_page_name});
	print $PREF{process_order_page_intro} . "\n";

	if(@items)
	{
		print qq`<table id="selections_table">\n`;
		my $i = 1;
		foreach my $item (sort @items)
		{
			my ($path, $file) = ($item =~ m!(.*)/(.+)!);
			unless($file) { $file = $item; $path = (); }
			print qq`<tr class=` . ($i % 2 == 0 ? 'even' : 'odd') . qq`><td>$i: <a href="` . get_download_link('filelist_page', $path, $file) . qq`">$item</td></tr>\n`;
			$i++;
		}
		print qq`</table>\n`;
	}

	finish_html_output();
	
}


sub create_db_tables_if_DNE
{
	create_db_table_for_temp_data() if $PREF{use_database_for_temp_data} =~ /yes/i;
	create_db_table_for_upload_info() if $PREF{store_upload_info_in_database} =~ /yes/i;
	create_db_table_for_download_info() if $PREF{log_all_downloads} =~ /yes/i;
}


sub create_db_table_for_temp_data
{
	my $table = $PREF{table_name_for_temp_data};
	unless(db_table_exists($table))
	{
		printd "table '$table' does not exist; attempting to create it now.";

		my $statement	= qq`CREATE TABLE $table `
				. qq`(serial VARCHAR(150) NOT NULL PRIMARY KEY, `
				. qq`progress TEXT, `
				. qq`currentfile SMALLINT, `
				. qq`totalfiles SMALLINT, `
				. qq`totalsize INT UNSIGNED, `
				. qq`start_time INT UNSIGNED); `;

		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("couldn't create table '$table': $DBI::errstr");

		printd "created table '$table' successfully.";
	}
}


sub create_db_table_for_upload_info()
{
	my $table = $PREF{upload_log_table};
	unless(db_table_exists($table))
	{
		printd "table '$table' does not exist; attempting to create it now.";

		my $statement = "
		CREATE TABLE `$table` (
		`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
		`filepath` TEXT,
		`filename` VARCHAR(255),
		`origpath` TEXT,
		`origname` VARCHAR(255),
		`rawname` VARCHAR(255),
		`extension` VARCHAR(20),
		`filesize` BIGINT UNSIGNED,
		`uploadsize` BIGINT UNSIGNED,
		`filecount` INT UNSIGNED,
		`serial` VARCHAR(80),
		`ip` VARCHAR(40),
		`host` VARCHAR(150),
		`userdir` VARCHAR(255),
		`username` VARCHAR(255),
		`useragent` VARCHAR(255),
		`starttime` VARCHAR(13),
		`endtime` VARCHAR(13),
		`startetime` BIGINT UNSIGNED,
		`endetime` BIGINT UNSIGNED,
		`elapsecs` INT UNSIGNED,
		`elapmins` FLOAT UNSIGNED,
		`elaphours` FLOAT UNSIGNED,
		`counternum` INT UNSIGNED
		)
		";

		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("couldn't create table '$table': $DBI::errstr");

		printd "created table '$table' successfully.";
	}
	if( ! db_column_exists('rawname', $table) )
	{
		my $sth = $PREF{dbh}->prepare("ALTER TABLE `$table` ADD `rawname` VARCHAR(255) NOT NULL");
		$sth->execute() or die_nice "could not add 'rawname' column to table '$table': $DBI::errstr\n";
		enc_warn "added column 'rawname' to table '$table'.";
	}
	if( ! db_column_exists('extension', $table) )
	{
		my $sth = $PREF{dbh}->prepare("ALTER TABLE `$table` ADD `extension` VARCHAR(20) NOT NULL");
		$sth->execute() or die_nice "could not add 'extension' column to table '$table': $DBI::errstr\n";
		enc_warn "added column 'extension' to table '$table'.";
	}
}


sub create_db_table_for_download_info()
{
	my $table = $PREF{download_log_table};
	unless(db_table_exists($table))
	{
		printd "table '$table' does not exist; attempting to create it now.";

		my $statement = "
		CREATE TABLE `$table` (
		`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
		`path` TEXT,
		`file` VARCHAR(255),
		`size` BIGINT UNSIGNED,
		`ip` VARCHAR(40),
		`host` VARCHAR(150),
		`userdir` VARCHAR(255),
		`username` VARCHAR(255),
		`useragent` VARCHAR(255),
		`date` VARCHAR(13),
		`etime` BIGINT UNSIGNED
		)
		";

		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("couldn't create table '$table': $DBI::errstr");

		printd "created table '$table' successfully.";
	}
}


sub create_perms_table_if_DNE
{
	my $oldtable = $PREF{old_perms_table};
	unless(db_table_exists($oldtable))
	{
		printd "table '$oldtable' does not exist; attempting to create it now.";

		my $statement =	  "CREATE TABLE `$oldtable` ("
				. " `id` BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY, "
				. " `path` TEXT NOT NULL, "
				. " `rousers` TEXT, "
				. " `rogroups` TEXT, "
				. " `rwusers` TEXT, "
				. " `rwgroups` TEXT "
				. ")";
		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("couldn't create table '$oldtable': $DBI::errstr");

		printd "created table '$oldtable' successfully.";
	}

	my $newtable = $PREF{new_perms_table};
	unless(db_table_exists($newtable))
	{
		printd "table '$newtable' does not exist; attempting to create it now.";

		my $statement =	  "CREATE TABLE `$newtable` ("
				. " `id` BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY, "
				. " `path` TEXT NOT NULL, "
				. " `readusers` TEXT, "
				. " `readgroups` TEXT, "
				. " `writeusers` TEXT, "
				. " `writegroups` TEXT, "
				. " `deniedusers` TEXT, "
				. " `deniedgroups` TEXT "
				. ")";
		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("couldn't create table '$newtable': $DBI::errstr");

		printd "created table '$newtable' successfully.";
	}
}


sub create_file_and_dir_info_table_if_DNE
{
	my $table = $PREF{file_and_dir_info_table};
	unless(db_table_exists($table))
	{
		printd "table '$table' does not exist; attempting to create it now.";

		# Note: 'path' must include at least a directory, and can also include
		# a filename -- i.e. it can specify just a directory or a full dir+filename.
		#
		my $statement =	  "CREATE TABLE `$table` ("
				. " `id` BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY, "
				. " `path` TEXT NOT NULL, "


				# Sellable item options (update 201203: putting this approach on hold for now):
				#
				#. " `sellable_item_name` VARCHAR(255) NOT NULL, "
				#. " `sellable_item_code` VARCHAR(30) NOT NULL, "
				#. " `sellable_item_description` TEXT NOT NULL, "
				#. " `sellable_item_options` TEXT NOT NULL, "
				#. " `sellable_item_price` DECIMAL(10,2) NOT NULL, "


				#. " `link_text` TEXT NOT NULL " # 20110401: what is this??


				# 201203: for CornerStore integration:
				#
				. " `sellable_item_context` INT UNSIGNED NOT NULL, "
				. " `sellable_item_linktext` VARCHAR(255) NOT NULL, "
				. " `sellable_item_code` VARCHAR(30) NOT NULL "


				# In dev:
				#
				#. " `comment_ids` TEXT NOT NULL "

				. ")";
		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("couldn't create table '$table': $DBI::errstr");

		printd "created table '$table' successfully.";
	}

	# In dev:
	#
	#if( ! db_column_exists('comment_ids', $table) )
	#{
	#	my $sth = $PREF{dbh}->prepare("ALTER TABLE `$table` ADD `comment_ids` TEXT NOT NULL");
	#	$sth->execute() or die_nice "could not add 'comment_ids' column to table '$table': $DBI::errstr\n";
	#	enc_warn "added column 'comment_ids' to table '$table'.";
	#}
}


sub create_comments_table_if_DNE
{
	return; # In development.
	
	my $table = $PREF{comments_table};
	unless(db_table_exists($table))
	{
		printd "table '$table' does not exist; attempting to create it now.";

		my $statement =	  "CREATE TABLE `$table` ("
				. " `id` BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY, "
				. " `timestamp` BIGINT UNSIGNED NOT NULL, "
				. " `name` VARCHAR(50) NOT NULL, "
				. " `email` VARCHAR(90) NOT NULL, "
				. " `website` VARCHAR(255) NOT NULL, "
				. " `approved` TINYINT(1) UNSIGNED NOT NULL DEFAULT 0, "
				. " `pending_approval` TINYINT(1) UNSIGNED NOT NULL DEFAULT 0, "
				. " `ip_address` VARCHAR(40) NOT NULL, "
				. " `hostname` VARCHAR(255) NOT NULL, "
				. " `browser` VARCHAR(255) NOT NULL, "
				. " `comment` TEXT NOT NULL "

				. ")";
		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("couldn't create table '$table': $DBI::errstr");

		printd "created table '$table' successfully.";
	}
}


# Prereqs: input args must be sql_untaint()ed before calling.
#
sub update_file_and_dir_info_table($$)
{
	return unless $PREF{database_is_in_use};
	my ($oldpath,$newpath) = @_;
	
	# This works for updating a single file, but if the move/rename was actually a folder,
	# then we potentially have multiple records that need updating, so we need to loop.
	#
	#my $statement = "UPDATE `$PREF{file_and_dir_info_table}` SET `path` = '$newpath' WHERE `path` = '$oldpath'";
	#print STDERR "statement: $statement\n";
	#my $success = enc_sql_update($statement);
	#print STDERR "success=$success\n";
	#return $success ? 0 : qq`Error: SQL returned '$success' instead of '1' while updating table '$PREF{file_and_dir_info_table}'.`;

	my $errors = '';
	my $matching_records = enc_sql_select_multi("SELECT `id`,`path` FROM `$PREF{file_and_dir_info_table}` WHERE `path` LIKE '$oldpath%'");
	foreach my $k (sort keys %$matching_records)
	{
		my $updated_path = $$matching_records{$k}{path};
		$updated_path =~ s!^$oldpath!$newpath!;
		my $statement = "UPDATE `$PREF{file_and_dir_info_table}` SET `path` = '$updated_path' WHERE `id` = $$matching_records{$k}{id}";
		my $success = enc_sql_update($statement);
		print STDERR "old path was: $oldpath\nstatement: $statement\nsuccess=$success\n";
		if($success == 1)
		{
			encdebug qq`updated record $$matching_records{$k}{id} in the file_and_dir_info_table, changing path from '$$matching_records{$k}{path}' to '$updated_path'`;		
		}
		else
		{
			$errors .= qq`Error: SQL returned '$success' instead of '1' while updating table '$PREF{file_and_dir_info_table}'.  [[SQL was: $statement]] [[old path was: $oldpath]] \n\n`;
		}
	}

	return $errors;
}


sub delete_directory
{
	my $dir = shift;
	my ($files, $subfolders) = get_items($dir);

	# first delete the files.
	#
	foreach my $file (@$files)
	{
		$file = enc_untaint($file, 'keep_path');

		# can never be too safe...
		if($file =~ /^\Q$PREF{uploaded_files_realpath}\E/)
		{
			if($PREF{uploaded_files_realpath} =~ /^\Q$PREF{DOCROOT}\E/   ||   $PREF{uploaded_files_dir_is_in_docroot} =~ /no/i)
			{
				#printd "unlinking $file\n";
				unlink($file) or die qq`$0: couldn't unlink (delete) file "$file": $!\n`;
			}
			else
			{
				die_nice qq`refusing to unlink "$file" because \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}) does not appear to be within \$PREF{DOCROOT} ($PREF{DOCROOT}).\n`;
			}
		}
		else
		{
			die_nice qq`refusing to unlink "$file" because it doesn't appear to be within \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}).\n`;
		}
	}


	# next delete the folders.
	# start with the longest pathname to ensure we delete subdirectories before parent directories.
	#
	foreach my $folder (sort { length($b) <=> length($a) } @$subfolders)
	{
		$folder = enc_untaint($folder, 'keep_path');

		# can never be too safe...
		if($folder =~ /^\Q$PREF{uploaded_files_realpath}\E/)
		{
			if($PREF{uploaded_files_realpath} =~ /^\Q$PREF{DOCROOT}\E/   ||   $PREF{uploaded_files_dir_is_in_docroot} =~ /no/i)
			{
				#printd "rmdir-ing $folder\n";
				rmdir($folder) or die qq`$0: couldn't rmdir (delete) directory "$folder": $!\n`;
				delete_custom_perms_for_folder($folder);
			}
			else
			{
				die_nice qq`refusing to rmdir "$folder" because \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}) does not appear to be within \$PREF{DOCROOT} ($PREF{DOCROOT}).\n`;
			}
		}
		else
		{
			die_nice qq`refusing to rmdir "$folder" because it doesn't appear to be within \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}).\n`;
		}
	}


	# finally, delete the requested folder itself.
	#
	# can never be too safe...
	if($dir =~ /^\Q$PREF{uploaded_files_realpath}\E/)
	{
		$dir = enc_untaint($dir, 'keep_path');

		if($PREF{uploaded_files_realpath} =~ /^\Q$PREF{DOCROOT}\E/   ||   $PREF{uploaded_files_dir_is_in_docroot} =~ /no/i)
		{
			#printd "rmdir-ing $dir\n";
			rmdir($dir) or die qq`$0: couldn't rmdir (delete) directory "$dir": $!\n`;
			delete_custom_perms_for_folder($dir);
		}
		else
		{
			die_nice qq`refusing to rmdir "$dir" because \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}) does not appear to be within \$PREF{DOCROOT} ($PREF{DOCROOT}).\n`;
		}
	}
	else
	{
		die_nice qq`refusing to rmdir "$dir" because it doesn't appear to be within \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}).\n`;
	}
}


# EB, FC
sub delete_files_and_folders_older_than
{
	my $ttl = shift;
	my $dir = shift;
	my $regex = shift; # optional; if present, only matching files will be deleted.

	return unless -d $dir;

	my ($files, $subfolders) = get_items($dir);

	# first delete the files.
	#
	foreach my $file (@$files)
	{
		$file = enc_untaint($file, 'keep_path');

		# Note: $file includes the full path.
		next if ($regex && $file !~ /$regex/);

		# can never be too safe...
		if($file =~ /^(\Q$PREF{uploaded_files_realpath}\E|\Q$PREF{datadir}\E|\Q$PREF{appdir_real}\E)/)
		{
			if($PREF{uploaded_files_realpath} =~ /^\Q$PREF{DOCROOT}\E/   ||   $PREF{uploaded_files_dir_is_in_docroot} =~ /no/i)
			{
				if(item_is_older_than($file, $ttl))
				{
					#printd "unlinking $file\n";
					unlink($file) or die_nice qq`couldn't unlink (delete) file "$file": $!\n`;
				}
			}
			else
			{
				die_nice qq`refusing to unlink "$file" because \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}) does not appear to be within \$PREF{DOCROOT} ($PREF{DOCROOT}).\n`;
			}
		}
		else
		{
			die_nice qq`refusing to unlink "$file" because it doesn't appear to be within \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}), \$PREF{datadir} ($PREF{datadir}), or \$PREF{appdir_real} ($PREF{appdir_real}).\n`;
		}
	}


	# next delete the folders.
	# start with the longest pathname to ensure we delete subdirectories before parent directories.
	#
	foreach my $folder (sort { length($b) <=> length($a) } @$subfolders)
	{
		$folder = enc_untaint($folder, 'keep_path');

		next if ($regex && $folder !~ /$regex/);

		# can never be too safe...
		if($folder =~ /^\Q$PREF{uploaded_files_realpath}\E/)
		{
			if($PREF{uploaded_files_realpath} =~ /^\Q$PREF{DOCROOT}\E/   ||   $PREF{uploaded_files_dir_is_in_docroot} =~ /no/i)
			{
				if(item_is_older_than($folder, $ttl))
				{
					my $numitems = count_items___raw($folder);
					if($numitems > 0)
					{
						enc_warn qq`$0: won't attempt to rmdir directory "$folder" because it isn't empty.\n`;
					}
					else
					{
						#printd "rmdir-ing $folder\n";
						rmdir($folder) or die qq`$0: couldn't rmdir (delete) directory "$folder": $!\n`;
					}
				}
			}
			else
			{
				die_nice(qq`refusing to rmdir "$folder" because \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}) does not appear to be within \$PREF{DOCROOT} ($PREF{DOCROOT}).\n`);
			}
		}
		else
		{
			die_nice(qq`refusing to rmdir "$folder" because it doesn't appear to be within \$PREF{uploaded_files_realpath} ($PREF{uploaded_files_realpath}).\n`);
		}
	}
}


# EB, FC
sub item_is_older_than
{
	my $item = shift;
	my $allowed_hours = shift;

	my $mtime = (stat($item))[9];
	my $current_time = time;
	return unless ($mtime =~ /^\d{2,}$/   &&   $current_time =~ /^\d{2,}$/);

	my $age_in_seconds = $current_time - $mtime;
	my $age_in_hours = $age_in_seconds / 3600;

	if($age_in_hours > $allowed_hours)
	{
		#printd "item_is_older_than(): item $item has age $age_in_hours, which exceeds allowed hours ($allowed_hours).\n";
		return 1;
	}
	else
	{
		return 0;
	}
}


sub get_dir_size
{
	my $dir = shift;
	my ($files,undef) = scan_dir_for_contents($dir, 'return_the_items_themselves');
	my $totalsize = 0;
	foreach my $file (@$files)
	{
		$totalsize += (stat($file))[7];
	}
	return $totalsize;
}


sub count_items___raw
{
	my $dir = shift;
	opendir(DIRFH, $dir) or die_nice "couldn't open directory '$dir': $!\n";
	my $dirh = \*DIRFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
	my @items = grep { !/^\.{1,2}$/ } readdir($dirh);
	closedir $dirh or die_nice "couldn't close directory '$dir': $!\n";
	return scalar @items;
}


# note: returns (numfiles,numdirs).
sub count_items
{
	my $dir = shift;
	my $arg = shift;
	return scan_dir_for_contents($dir, 'return_the_item_counts', $arg);
}


# EB, FC, photos
sub get_items
{
	my $dir = shift;
	return scan_dir_for_contents($dir, 'return_the_items_themselves');
}


# EB, FC, photos
sub scan_dir_for_contents
{
	#print STDERR "scan_dir_for_contents('$_[0]')\n";

	my $dir = shift;
	my $mode = shift;
	my $ignore_hidden_items = shift; $ignore_hidden_items = $ignore_hidden_items && $ignore_hidden_items eq 'ignore_hidden_items' ? 1 : 0;
	#printd "\n\ndir: $dir\n";
	my @all_dirs = ($dir);

	my @all_subdirs = get_all_subdirs($dir);
	for(@all_subdirs)
	{
		push @all_dirs, $dir . '/' . $_;
	}

	my @all_files = ();
	foreach my $subdir (@all_dirs)
	{
		# don't use images from our own thumbnail folders.
		next if $ignore_hidden_items && $subdir =~ m!(^|/|\\)$PREF{filelist_thumbnail_dir_name}(/|\\|$)!;
		next unless -r $subdir; # if we encounter an unreadable subdir, don't die, just skip it.

		opendir(SCANDIRFH, $subdir) or die "$0: 22 couldn't open directory $subdir: $!\n";
		my $dirh = \*SCANDIRFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		my @files = grep {  ! -d "$subdir/$_" } readdir($dirh);
		closedir $dirh or die "$0: couldn't close directory $subdir: $!\n";
		for(@files)
		{
			push @all_files, $subdir . '/' . $_;
		}
		#printd "subdir $subdir contains:" . join ", ", @files; printd "\n";
	}

	if($mode eq 'return_the_items_themselves')
	{
		my @all_subdirs_with_paths = ();
		for(@all_subdirs)
		{
			push @all_subdirs_with_paths, $dir . '/' . $_;
		}
		return (\@all_files, \@all_subdirs_with_paths);
	}
	elsif($mode eq 'return_the_item_counts')
	{
		my ($numfiles, $numdirs) = ($#all_files + 1, $#all_subdirs + 1);
		#printd "numfiles=$numfiles, numdirs=$numdirs\n";
		return ($numfiles, $numdirs);
	}
}


sub get_all_writable_directories
{
	my $optsref = shift; my %options = %$optsref if $optsref;
	#print STDERR "get_all_writable_directories('$_[0]')\n";

	my $num_static_writable_dirs = scalar @{ $PREF{static_writable_directories_list} };
	my $first_static_writable_dir = @{ $PREF{static_writable_directories_list} }[0];
	# Two tests here, because only testing the @{ ... } array will return true even if the only contents are a single empty string.
	return @{ $PREF{static_writable_directories_list} } if ($num_static_writable_dirs > 0) && ($first_static_writable_dir !~ /^\s*$/);

	my $inputdir = $PREF{uploaded_files_realpath};
	my @dirs = get_all_subdirs($inputdir);
	$inputdir =~ s/^$PREF{uploaded_files_realpath}//;
	$inputdir = '/' unless $inputdir;
	unshift @dirs, $inputdir;

	# This code is sort of awkward to handle the custom folder perms
	# and the userdirs when they interact with each other.  This seems
	# to be the most straightforward way to code it.  Note that the
	# chain here must be if/elsif, not multiple ifs: we're handling
	# each case one at a time in its entirety, rather than doing
	# multiple ifs on the outside and trying to combine the results
	# afterwards.

	my (%output,@output) = ();
	if($PREF{admin_is_logged_in})
	{
		return @dirs;
	}
	elsif(custom_folder_perms_enabled())
	{
		foreach my $dir (@dirs)
		{
			#printd "alldirs: '$dir'\n";
			if(folder_perms_allow_writing($dir))
			{
				printd "dir: '$dir' writable (via folder perms)\n";
				$output{$dir} = 1;
			}
			#elsif(is_a_userdir_folder($dir))
			#{
			#	if(is_userdir_folder_that_this_user_can_access($dir))
			#	{
			#		$output{$dir} = 1;
			#	}
			#}

			# 20110224: get_effective_folder_permissions() does userdir checking
			# internally, so this separate check here is redundant:
			#
			#elsif(is_userdir_folder_that_this_user_can_access($dir))
			#{
			#	printd "dir: '$dir' writable (via userdir)\n";
			#	$output{$dir} = 1;
			#}
		}

		#foreach my $dir (sort { length($a) <=> length($b) } keys %output)
		foreach my $dir (sort { lc($a) cmp lc($b) } keys %output)
		{
			#printd "writable: $dir\n";
			push @output, $dir;
		}

		return @output;
	}
	elsif($PREF{enable_userdirs} =~ /yes/i)
	{
		foreach my $dir (@dirs)
		{
			#printd "dir: '$dir'\n";
			if(is_userdir_folder_that_this_user_can_write($dir))
			{
				#printd "userdir '$dir' writable\n";
				$output{$dir} = 1;
			}
		}

		#foreach my $dir (sort { length($a) <=> length($b) } keys %output)
		foreach my $dir (sort { lc($a) cmp lc($b) } keys %output)
		{
			push @output, $dir;
		}

		return @output;
	}
	else
	{
		return @dirs;
	}
}


sub is_special_fc_folder($)
{
	return $_[0] =~ m!^($PREF{name_of_subfolder_for_thumbnails_etc}|$PREF{filelist_thumbnail_dir_name}|\.fc.*)$!i;
}


sub this_is_the_userdir_folder($)
{
	return $_[0] =~ m!^/*$PREF{userdir_folder_name}/*$!;
}


sub is_a_userdir_folder($)
{
	return 0 unless $PREF{enable_userdirs} =~ /yes/i;
	my $path = shift;
	if($path =~ m!^/?$PREF{userdir_folder_name}/+([^/]+)!)
	{
		my $userdir_from_path = $1;
		return is_special_fc_folder($userdir_from_path) ? 0 : 1;
	}
	else
	{
		return 0;
	}
}


sub is_userdir_folder_that_this_user_can_access($$)
{
	my $path = shift;
	my $action = shift; # read or write.
	return 0 unless is_a_userdir_folder($path);

	my $userdir_from_path = ($path =~ m!^/?$PREF{userdir_folder_name}/+([^/]+)!)[0];
	my $userdir_user_id = get_user_id($userdir_from_path);

	return (
			# user is an admin, etc:
			user_is_allowed_to($action . '_all_userdirs')   # read_all_userdirs or write_all_userdirs
		||
			# user is the folder owner:
			($PREF{userdir} eq $userdir_from_path   &&   $action eq 'read'   &&   $PREF{default_userdir_folder_rights} =~ /r/)
		||
			# user is the folder owner:
			($PREF{userdir} eq $userdir_from_path   &&   $action eq 'write'   &&   $PREF{default_userdir_folder_rights} =~ /w/)
		||
			# user is subgroup manager who owns the folder owner:   [TODO: probably want separate r/w controls for subgroup_managers too...]
			($userdir_from_path   &&   $userdir_user_id   &&   userbase_available()   &&   logged_in_user_is_subgroup_manager()   &&   logged_in_subgroup_manager_owns_this_user($userdir_user_id))
		||
			# user is owned by the subgroup manager who owns this folder:
			($userdir_from_path   &&   $userdir_user_id   &&   userbase_available()   &&   this_subgroup_manager_owns_this_user($userdir_user_id, $PREF{logged_in_userid})   &&   $action eq 'read'   &&   $PREF{subgroup_owned_users_can_read_the_userdir_of_their_subgroup_manager} =~ /yes/i)
		||
			# user is owned by the subgroup manager who owns this folder:
			($userdir_from_path   &&   $userdir_user_id   &&   userbase_available()   &&   this_subgroup_manager_owns_this_user($userdir_user_id, $PREF{logged_in_userid})   &&   $action eq 'write'   &&   $PREF{subgroup_owned_users_can_write_the_userdir_of_their_subgroup_manager} =~ /yes/i)

	);
}


sub is_userdir_folder_that_this_user_can_read($)
{
	return is_userdir_folder_that_this_user_can_access($_[0], 'read');
}


sub is_userdir_folder_that_this_user_can_write($)
{
	return is_userdir_folder_that_this_user_can_access($_[0], 'write');
}


sub get_userdir
{
	my $userdir = '';
	return '' unless $PREF{enable_userdirs} =~ /yes/i;
	return '' if $PREF{admin_is_logged_in}; # because admins are allowed to browse all user's dirs, and upload to anywhere they want.

	if($PREF{enable_userdir_from_login_system} =~ /yes/i)
	{
		$userdir = $PREF{userdir_template};
		exit_with_error qq`Your setting for \$PREF{userdir_template} must contain at least one of: %%username%%, %%userid%%, or %%email%% (and the corresponding field must be a required field [i.e., never null] in your login system) in order to ensure that each userdir is unique.` unless $PREF{userdir_template} =~ /(%%username%%|%%userid%%|%%email%%)/;

		my $realname = $PREF{logged_in_realname}; $realname =~ s!\W!_!g; # mainly for spaces, but also for dashes, parens, etc, that might appear in the realname field values.
		$userdir =~ s/%%username%%/$PREF{logged_in_username}/g;
		$userdir =~ s/%%userid%%/$PREF{logged_in_userid}/g;
		$userdir =~ s/%%email%%/$PREF{logged_in_email}/g;
		$userdir =~ s/%%realname%%/$realname/g;

		if(   (!$userdir || !$PREF{member_is_logged_in})   &&   $PREF{error_if_userdir_not_supplied} =~ /yes/i   )
		{
			if($PREF{integrate_with_userbase} =~ /yes/i || $PREF{integrate_with_userbase_method_b} =~ /yes/i)
			{
				$PREF{userbase_login_error_message} =~ s!%%login_link%%!<a href="$PREF{login_url}">log in</a>!g;
				$PREF{userbase_login_error_message} .= qq`\n<script type="text/javascript">location.href="$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{login_url}" + '?whence=' + location.href;</script>\n`;
				exit_with_notice($PREF{userbase_login_error_message});
			}
			else
			{
				exit_with_notice($PREF{login_error_message});
			}
		}
	}
	elsif($PREF{enable_userdir_from_cookie} =~ /yes/i)
	{
		$userdir = get_cookie($PREF{userdir_cookie_name});
		if(!$userdir && $PREF{error_if_userdir_not_supplied} =~ /yes/i)
		{
			exit_with_notice($PREF{login_error_message});
		}
	}
	elsif($PREF{enable_userdir_from_php_session__method1} =~ /yes/i)
	{
		if(exists $ENV{PHP_ENC_USERDIR})
		{
			$userdir = $ENV{PHP_ENC_USERDIR};
			save_php_var_to_cache('userdir',$userdir);
		}
		else # we were POSTed to?
		{
			$userdir = get_php_var_from_cache('userdir');
		}
		if(!$userdir && $PREF{error_if_userdir_not_supplied} =~ /yes/i)
		{
			exit_with_notice($PREF{login_error_message});
		}
	}
	elsif($PREF{enable_userdir_from_php_session__method2} =~ /yes/i)
	{
		eval { require PHP::Session; };
		if($@) { die_nice($@); }
		else
		{
			my $session = PHP::Session->new(   get_cookie($PREF{php_session_cookie_name}),  { save_path => $PREF{php_session_save_path} }   );
			$userdir = $session->get($PREF{php_session_username_variable});
		}
		if(!$userdir && $PREF{error_if_userdir_not_supplied} =~ /yes/i)
		{
			exit_with_notice($PREF{login_error_message});
		}
	}
	elsif($PREF{enable_userdir_on_url} =~ /yes/i)
	{
		if((my $udir = get_qs_var('userdir'))   &&   (my $hash = get_qs_var('userdirhash'))   &&   (my $secret = $PREF{userdir_shared_secret}))
		{
			if($hash eq enc_hash($udir . $secret))
			{
				$userdir = $udir;
			}
			else
			{
				exit_with_error(qq`The hash you passed ("$hash") doesn't match the one we computed for that userdir ("$udir"); check your shared secret and try again.`);
			}
		}
		elsif((my $udir = get_qs_var('userdir'))   &&   $PREF{allow_userdir_on_url_insecurely} =~ /yes/i   &&   $PREF{serial_is_userdir} !~ /yes/i)
		{
			# Note: serial_is_userdir doesn't need (and overrides) allow_userdir_on_url_insecurely,
			# so we'll ignore allow_userdir_on_url_insecurely if serial_is_userdir is set.

			$userdir = $udir;
		}
		elsif($PREF{serial_is_userdir} =~ /yes/i)
		{
			$userdir = get_qs_var('userdir') ? get_qs_var('userdir') : $PREF{serial};
		}

		if(!$userdir && $PREF{error_if_userdir_not_supplied} =~ /yes/i)
		{
			# if no userdir was passed, and the webmaster doesn't want that to be
			# an error, then we just have to return null and use the top-level
			# dir for this upload.

			exit_with_error($TEXT{Error_URL_missing_userdir});
		}
	}

	unless($PREF{allow_unsafe_userdir_names} =~ /yes/i)
	{
		$userdir = enc_untaint($userdir) if $userdir;
	}

	return $userdir;
}


sub file_is_allowed_to_be_displayed
{
	my $path = shift;
	my $item = shift;
	my $allowed = 1;

	if(logged_in_user_is_subgroup_manager() && ($PREF{enable_userdirs} =~ /yes/i) && this_is_the_userdir_folder($path))
	{
		# For subgroup managers, don't show any files in the root of the users folder.
		$allowed = 0;
	}
	if($PREF{only_show_files_with_these_extensions} =~ /(.+)/)
	{
		my ($this_items_extension) = ($item =~ /.*(\..+)$/);
		die qq`$0: could not determine the extension for item "$item".\n` unless ($this_items_extension || $PREF{allow_files_without_extensions} =~ /yes/i);
		unless(   $PREF{allowed_extensions}{lc($this_items_extension)}   )
		{
			$allowed = 0;
		}
	}
	if($PREF{hide_files_with_these_extensions} =~ /(.+)/)
	{
		my ($this_items_extension) = ($item =~ /.*(\..+)$/);
		die qq`$0: could not determine the extension for item "$item".\n` unless ($this_items_extension || $PREF{allow_files_without_extensions} =~ /yes/i);
		if(   $PREF{disallowed_extensions}{lc($this_items_extension)}   )
		{
			$allowed = 0;
		}
	}
	if(item_is_hidden($item))
	{
		$allowed = 0;
	}

	return $allowed;
}


sub folder_is_allowed_to_be_displayed
{
	#printd "folder_is_allowed_to_be_displayed('$_[0]')\n";

	my $item = shift || '';
	slashify($item);

	foreach my $dir (split(/\//, $item))
	{
		next unless $dir;
		if(item_is_hidden($dir))
		{
			return 0;
		}
	}
	if(custom_folder_perms_enabled())
	{
		return 0 unless folder_perms_allow_reading($item);
	}
	return 1;
}


sub item_is_hidden
{
	my $item = shift;
	if($PREF{hide_items_whose_names_match} =~ /(.+)/)
	{
		foreach my $disallowed_name (split(/[,\s]+/, $PREF{hide_items_whose_names_match}))
		{
			if($item =~ /$disallowed_name/i)
			{
				return 1;
			}
		}
	}
}


sub clean_up_filename
{
	for(@_) { s/\s+/_/g if $_; }
	for(@_) { s/[^0-9A-Za-z\._-]//g if $_; }
}


sub clean_up_text
{
	for(@_) { s/\s+/_/g if $_; }
	for(@_) { s/[^0-9A-Za-z\._-]//g if $_; }
}


sub get_storable_url_variables
{
	my $format = shift;
	my $hash_to_populate = shift;
	my $urldecode = shift; $urldecode = $urldecode eq 'urldecode' ? 1 : 0;
	my $urlvars = ();

	if($PREF{store_values_from_these_url_variables} =~ /\S/)
	{
		foreach my $var (split(/[,\s]+/, $PREF{store_values_from_these_url_variables}))
		{
			if($qs =~ /(?:^|&)$var=(.*?)(?:&|$)/)
			{
				my $value = $1;
				enc_urldecode($value) if $urldecode;

				my $urldecoded_value = $value; enc_urldecode($urldecoded_value);
				$$hash_to_populate{lc($var)} = $urldecoded_value if $hash_to_populate; # Always URL-decode this one because it's for the DB. Also lc() the key to prevent DB table casename problems on Windows.

				if($format =~ /^html$/i)
				{
					$urlvars .= qq`\n<p>URL Variable ${var}: $value</p>\n`;
				}
				else
				{
					$urlvars .= qq`\nURL Variable ${var}: $value\n\n`;
				}
			}
		}
	}

	return $urlvars;
}


sub store_upload_info
{
	my ($i, $filename_with_urlpath, $filename_with_localpath, $rawname, $extension, $filesize, $serial, $textboxes) = @_; # $textboxes is a hashref.

	my %INFO = (); # note: all keys in this hash must be lowercased, to prevent DB table casename problems on stupid systems (i.e. Windows).

	($INFO{filepath}, $INFO{filename}) = ($filename_with_localpath =~ m!^(.*[/\\])(.+)$!);
	$INFO{origpath}			= $INFO{filepath};
	$INFO{origname}			= $INFO{filename};

	$INFO{rawname}			= $rawname;
	$INFO{extension}		= $extension;

	$INFO{filesize}			= $filesize;
	$INFO{uploadsize}		= $ENV{CONTENT_LENGTH};
	$INFO{filecount}		= $PREF{uploaddata}{$serial}{totalfiles};
	$INFO{serial}			= $serial;

	($INFO{ip},$INFO{host})		= ($PREF{ip},$PREF{host});

	$INFO{userdir}			= $PREF{userdir} || '(none)';
	$INFO{username}			= $PREF{logged_in_username} ? $PREF{logged_in_username} : '(none)';
	$INFO{useragent}		= $ENV{HTTP_USER_AGENT};

	$INFO{startetime}		= $PREF{uploaddata}{$serial}{start_time};
	$INFO{starttime}		= strftime("%Y%m%d-%H%M",		localtime($INFO{startetime}));

	$INFO{endetime}			= $PREF{uploaddata}{$serial}{end_time};
	$INFO{endtime}			= strftime("%Y%m%d-%H%M",		localtime($INFO{endetime}));

	$INFO{elapsecs}			= $INFO{endetime} - $INFO{startetime};
	$INFO{elapmins}			= $INFO{elapsecs} / 60;
	$INFO{elaphours}		= $INFO{elapsecs} / 3600;
	s/(.*\.\d).*/$1/ for ($INFO{elapmins}, $INFO{elaphours});

	$INFO{counternum}		= $PREF{upload_counter_value};

	# get any URL variable values (into %INFO hash).
	my $all_url_vars = get_storable_url_variables('text', \%INFO);

	# get any custom textbox values (into %INFO hash).
	foreach my $textbox (keys %$textboxes)
	{
		my $textbox_without_filenumber = $textbox;
		$textbox_without_filenumber =~ s/^(formfield_\w+)_\d+$/$1/; # remove trailing digit in case this is a perfile textbox.
		my $shortname = $PREF{"${textbox_without_filenumber}_shortname"};
		my $shortname_for_db = lc($shortname);

		if($textbox ne $textbox_without_filenumber) # then it's a perfile textbox
		{
			if($textbox =~ /_$i$/) # make sure we get the value from the textbox for the proper file (the one ending in the current $i)
			{
				$$textboxes{$textbox}{value} =~ s/^$PREF{"${textbox}_group_separator"}//; # this PREF is null when it doesn't apply, so no harm done in removing it.
				$INFO{$shortname_for_db} = $$textboxes{$textbox}{value};
			}
		}
		else
		{
			my $value = $$textboxes{$textbox}{value};

			if($PREF{"${textbox}_password"} =~ /yes/i   &&   $value)
			{
				# Don't modify the value directly in the %textboxes hash, because
				# we need that to be the plaintext version so it can be included
				# in notification emails.
				#
				$value = md5_hex($value);
			}

			$value =~ s/^$PREF{"${textbox}_group_separator"}//; # this PREF is null when it doesn't apply, so no harm done in removing it.
			$INFO{$shortname_for_db} = $value;
		}
	}


	if($PREF{store_upload_info_in_database} =~ /yes/i)
	{
		my ($cols_for_query,$vals_for_query,%cols_already_done) = ('','',());
		my $query = qq`INSERT INTO $PREF{upload_log_table} `;
		foreach my $col (split(/\s*,\s*/, $PREF{db_columns_for_upload_info}))
		{
			next if $cols_already_done{$col};
			$cols_already_done{$col} = 1;

			my $varname = $PREF{db_column_name_conversions}{$col} ? $PREF{db_column_name_conversions}{$col} : $col;
			$varname = lc($varname);
			next if $INFO{$varname} eq ''; # if it's null, don't bother; otherwise we get an "Out of range value adjusted for column" error from MySQL.
			#$INFO{$varname} =~ s/::NEWLINE::/\n/g;
			sql_untaint($col,$INFO{$varname});
			die_unless_sqlsafe($col, $INFO{$varname});
			$cols_for_query .= $col . ',';
			$vals_for_query .= qq`'$INFO{$varname}',`;
		}
		$cols_for_query =~ s/,$//;
		$vals_for_query =~ s/,$//;
		$query .= qq`($cols_for_query) VALUES($vals_for_query);`;

		my $sth = $PREF{dbh}->prepare($query);
		$sth->execute() or die_nice "$DBI::errstr\n";
	}

	if($PREF{enable_custom_sql_commands} =~ /yes/i)
	{
		foreach my $sqlcmd (keys %{$PREF{custom_sql_command}})
		{
			my $statement = $PREF{custom_sql_command}{$sqlcmd};
			next unless $statement;

			interpolate_vars_from_URL_and_cookies('include_undefined', $statement);
			interpolate_vars_from_prefs($statement);

			#interpolate_vars_from_formfields($textboxes, $statement);
			$statement =~ s/%FIELD{(\w+)}/$INFO{$1}/g;

			$statement =~ /^INSERT/ ? enc_sql_insert($statement) : enc_sql_update($statement);
		}
	}
}


sub format_filesize_nicely
{
	my $size = shift;
	my $unit = shift; # optional
	$size = 0 unless $size;

	# Note: for small numbers, this will return a value with an exponential, e.g.:
	#
	#	$ perl -e 'print 5/(1024*1024)'		prints: 4.76837158203125e-06
	#	$ perl -e 'print 10/(1024*1024)'	prints: 9.5367431640625e-06
	#	$ perl -e 'print 100/(1024*1024)'	prints: 9.5367431640625e-05
	#	$ perl -e 'print 1000/(1024*1024)'	prints: 0.00095367431640625
	#	$ perl -e 'print 10000/(1024*1024)'	prints: 0.0095367431640625
	#	$ perl -e 'print 100000/(1024*1024)'	prints: 0.095367431640625
	#
	# To avoid this, we'll shortcut it for any sizes less than 100,000; with
	# onedecimal(), those would always end up as 0.0 anyway (in terms of MB).
	#
	my $mbsize = $size < 100000 ? '0.0' : onedecimal($size/(1024*1024));
	$mbsize = '0.1' if $mbsize eq '0.0' && $size > 0; # for tiny but non-empty files, round to 0.1 instead of 0.0.
	$mbsize .= " $PREF{MB}";

	my $kbsize = int($size/1024);
	$kbsize = 1 if $kbsize eq '0' && $size > 0; # for tiny but non-empty files, round to 1 instead of 0.
	$kbsize .= " $PREF{KB}";

	if($unit =~ /mb/i)	{ $size = $mbsize;				}
	elsif($unit =~ /kb/i)	{ $size = $kbsize;				}
	else			{ $size = $size > 999999 ? $mbsize : $kbsize;	}

	return $size;
}


sub show_fileinfo
{
	exit_with_access_denied() unless user_is_allowed_to('view_upload_info');

	my $path = shift;
	my $file = shift;

	enc_urldecode($path, $file);

	$file = enc_untaint($file);
	$path = enc_untaint($path, 'keep_path') if $path;

	#clean_up_filename($dst) if $PREF{clean_up_filenames} =~ /yes/i;

	my (%INFO,%textboxes,%urlvars) = ();
	my $template = $PREF{file_info_page_template};

	# make a hash of our built-in fields, so we can properly detect custom fields.
	my $builtin_info_fields = 'filepath,filename,origpath,origname,rawname,extension,filesize,uploadsize,filecount,serial,ip,host,userdir,username,useragent,starttime,endtime,startetime,endetime,elapsecs,elapmins,elaphours,counternum';
	my %builtin_info_fields = map { $_ => 1 } split(/,/, $builtin_info_fields);

	start_html_output($TEXT{Upload_Info});
	print qq`<h1>$TEXT{Upload_Info}</h1>\n\n`;

	if($PREF{store_upload_info_in_database} =~ /yes/i)
	{
		print "<!-- (info from db) -->\n";

		$path .= '/' if(!$path || $path !~ m!/$!);
		$path = "/$path" unless $path =~ m!^/!;

		$PREF{fileinfo_query} = qq`SELECT $PREF{db_columns_for_upload_info} FROM $PREF{upload_log_table} WHERE filename='%%file%%' AND filepath='%%path%%' LIMIT 1` unless exists $PREF{fileinfo_query};
		$PREF{fileinfo_query} =~ s/%%file%%/$file/g;
		$PREF{fileinfo_query} =~ s/%%path%%/$path/g;
		#printd "query=$PREF{fileinfo_query}\n";
		my $fileinfo = $PREF{dbh}->selectrow_hashref($PREF{fileinfo_query});
 
		foreach my $field (split(/\s*,\s*/, $PREF{db_columns_for_upload_info}))
		{
			my $value = $fileinfo->{$field};
			$INFO{$field} = $value;
		}
	}

	$INFO{filesize} = format_filesize_nicely($INFO{filesize}) if $INFO{filesize} =~ /^\d+$/;
	$INFO{uploadsize} = format_filesize_nicely($INFO{uploadsize}) if $INFO{uploadsize} =~ /^\d+$/;



	# Also auto-generate any custom form field values in case the
	# template contains the %%formfields%% variable.
	#
	my $formfields = '';
	foreach my $field (sort keys %INFO)
	{
		next if $field =~ /^filepw(verify)?$/; # don't display any per-file passwords.

		unless($builtin_info_fields{$field})
		{
			#print STDERR "\nfield='$field'\n";
			my $formfieldkey = get_formfield_key_from_shortname($field);
			next unless $formfieldkey =~ /^formfield_/;
			my $value = $INFO{$field};
			if($PREF{"${formfieldkey}_checkbox"} =~ /yes/i) { $value = $value ? $TEXT{yes} : $TEXT{no}; }
			my $name = $PREF{$formfieldkey} ? $PREF{$formfieldkey} : $PREF{"${formfieldkey}_shortname"};
			$formfields .= qq`\n<tr><td class="f"><!-- \$formfieldkey='$formfieldkey' --> $name</td> <td class="v">$value</td></tr>`;
		}
	}
	$template =~ s!%%%if-formfields%%%(.+?)%%%end-formfields%%%!$formfields ? $1 : ''!egs;
	$template =~ s!%%formfields%%!$formfields!g;


	my $imagedetails = '';
	my $fullfile = "$PREF{uploaded_files_realpath}/$path/$file";
	if(is_image($fullfile))
	{
		my ($width,$height,$xres,$yres,$width_inches,$height_inches) = get_image_dims($fullfile);
		if($width && $height)			{ $imagedetails = 1; $template =~ s!%%imagedims%%!${width}x${height}!g;	}			else { $template =~ s!%%imagedims%%!$TEXT{unknown}!g;		}
		if($xres && $yres)			{ $imagedetails = 1; $template =~ s!%%imageres%%!${xres}x${yres}!g;	}			else { $template =~ s!%%imageres%%!$TEXT{unknown}!g;		}
		if($width_inches && $height_inches)	{ $imagedetails = 1; $template =~ s!%%imagedims_inches%%!${width_inches}x${height_inches}!g; }	else { $template =~ s!%%imagedims_inches%%!$TEXT{unknown}!g;	}
	}
	$template =~ s!%%%if-image_details_available%%%(.+?)%%%end-image_details_available%%%!$imagedetails ? $1 : ''!egs;


	$template =~ s/%%(\w+)%%/$INFO{$1}/g;
	print $template;

	finish_html_output();
}


sub show_upload_session_info()
{
	exit_with_access_denied() unless user_is_allowed_to('view_upload_info');

	my %dbfields = ();
	foreach my $pref (keys %PREF)
	{
		if($pref =~ /^upload_session_info_url_arg_(\d+)$/)
		{
			my $num = $1;
			my $abbr = $PREF{$pref};
			my $shortname = $PREF{"${pref}_shortname"};
			$dbfields{$abbr} = $shortname;
		}
	}

	my %qsvars = ();
	foreach my $var (split(/&/, $qs))
	{
		my ($param,$value) = ($var =~ /(.+?)=(.*)/);
		next if $param eq 'action';
		enc_urldecode($value);
		$qsvars{$param} = $value;
	}

	my $statement_backend = " WHERE ";
	foreach my $qsvar (keys %qsvars)
	{
		sql_untaint($dbfields{$qsvar}, $qsvars{$qsvar});
		$statement_backend .= "`$dbfields{$qsvar}` = '$qsvars{$qsvar}' AND ";
	}
	$statement_backend =~ s/\s*AND\s*$//;
	$statement_backend .= ';';

	my %dbvalues = ();
	my $templatable_item = $PREF{upload_session_info_template};

					my (@to_be_replaced, @replacement) = ();

					while($templatable_item =~ /(%{2,3}(.+?)%{2,3})/g)
					{
						my ($placeholder, $var_raw, $var) = ($1, $2, undef);
						next if $placeholder =~ /^%%%(.+)%%%$/; # skip any %%%if-foo%%%s, etc.

						if($var_raw =~ /^(.+?)--/)	{ $var = $1; }
						elsif($var_raw eq 'filelist')	{ next; }
						else				{ $var = $var_raw; }

						$var = 'filepath' if $var eq 'finalpath_local';

						sql_untaint($var);
						my $value = enc_sql_select("SELECT `$var` FROM `$PREF{upload_log_table}`" . $statement_backend);

						if($var_raw =~ /--date--(.+?)(--|$)/)
						{
							my $format = $1;
							$format =~ s/#/%/g;
							$value = strftime($format, localtime($value));
						}
						if($var_raw =~ /--urlencode(--|$)/)
						{
							enc_urlencode($value);
						}
						if($var_raw =~ /--winslashes(--|$)/)
						{
							$value =~ s!/!\\!g;
						}

						# since we're outputting HTML here, replace newlines.
						$value =~ s!\n!<br />!g;

						push @to_be_replaced, $placeholder;
						push @replacement, $value;
					}

					my $k = 0;
					foreach my $string (@to_be_replaced)
					{
						$templatable_item =~ s/$string/$replacement[$k]/;
						$k++;
					}

	my $sth = $PREF{dbh}->prepare("SELECT `filepath`,`filename` FROM `$PREF{upload_log_table}`" . $statement_backend);
	$sth->execute() or die "$PREF{internal_appname}: show_upload_session_info(): SQL error while trying to select file info: $DBI::errstr\n";
	my ($filepath, $filename, @files) = ();
	$sth->bind_columns(\$filepath, \$filename);
	while($sth->fetchrow_arrayref)
	{
		my $href = get_download_link('filelist_page', $filepath, $filename);
		my $link = qq`<a href="$href">$filename</a>`;
		push @files, $link;
	}
	my $files = join "<br />\n", @files;
	$templatable_item =~ s/%%filelist%%/$files/;

	print_http_headers();
	start_html_output() if $PREF{include_builtin_html_with_upload_session_info} =~ /yes/i;
	print $templatable_item;
	finish_html_output() if $PREF{include_builtin_html_with_upload_session_info} =~ /yes/i;
}


sub show_upload_log
{
	$PREF{on_a_wide_page} = 1;

	my $tableprefname	= 'upload_log_table';
	my $viewerprefname	= 'upload_log';
	my $allowed_to_view	= user_is_allowed_to('view_upload_log_db');
	my $allowed_to_create	= user_is_allowed_to('create_upload_log_db_records');
	my $allowed_to_edit	= user_is_allowed_to('edit_upload_log_db');
	my $allowed_to_delete	= user_is_allowed_to('delete_upload_log_db_records');



	exit_with_error("This feature is disabled.") unless $PREF{store_upload_info_in_database} =~ /yes/i;

	$PREF{"${viewerprefname}_viewer_value_transforms"}{filesize}	= qq`%%variable%% = format_filesize_nicely(%%variable%%);`;


	if(!$allowed_to_view   &&   $PREF{groups_allowed_to_view_upload_log_db} =~ /(^|,)\s*self\s*(,|$)/   &&   $PREF{member_is_logged_in}   &&   $PREF{logged_in_username})
	{
		# If they don't belong to a normal group named in groups_allowed_to_view_upload_log_db, but
		# that setting does include "self", then allow access but use the selection restrictions to
		# limit their access.
		#
		$allowed_to_view = 1;
		$PREF{"${viewerprefname}_viewer_selection_restrictions"}= "WHERE `username` = '$PREF{logged_in_username}'";
	}
	if(!$allowed_to_edit   &&   $PREF{groups_allowed_to_edit_upload_log_db} =~ /(^|,)\s*self\s*(,|$)/   &&   $PREF{member_is_logged_in}   &&   $PREF{logged_in_username})
	{
		# Same for "edit".
		#
		$allowed_to_edit = 1;
		$PREF{"${viewerprefname}_editmode_restrictions"}	= "AND `username` = '$PREF{logged_in_username}'";
	}


	# Nothing below here should need to be edited in most cases:
	#
	# Call get_database_data() before starting any output in case we were POSTed
	# to and therefore we need to redirect instead of printing output.
	#
	my $output = get_database_data($tableprefname, $viewerprefname, $allowed_to_view, $allowed_to_create, $allowed_to_edit, $allowed_to_delete);
	start_html_output($PREF{"${viewerprefname}_viewer_title"});
	print $output;
	finish_html_output();
}


sub show_alternate_upload_log
{
	$PREF{on_a_wide_page} = 1;

	my $tableprefname	= 'upload_log_table';
	my $viewerprefname	= 'alternate_upload_log';
	my $allowed_to_view	= user_is_allowed_to('view_alt_upload_log_db');
	my $allowed_to_create	= user_is_allowed_to('create_alt_upload_log_db_records');
	my $allowed_to_edit	= user_is_allowed_to('edit_alt_upload_log_db');
	my $allowed_to_delete	= user_is_allowed_to('delete_alt_upload_log_db_records');



	exit_with_error("This feature is disabled.") unless $PREF{store_upload_info_in_database} =~ /yes/i;

	$PREF{"${viewerprefname}_viewer_value_transforms"}{filesize}	= qq`%%variable%% = format_filesize_nicely(%%variable%%);`;


	if(!$allowed_to_view   &&   $PREF{groups_allowed_to_view_alt_upload_log_db} =~ /(^|,)\s*self\s*(,|$)/   &&   $PREF{member_is_logged_in}   &&   $PREF{logged_in_username})
	{
		# If they don't belong to a normal group named in groups_allowed_to_view_alt_upload_log_db, but
		# that setting does include "self", then allow access but use the selection restrictions to
		# limit their access.
		#
		$allowed_to_view = 1;
		$PREF{"${viewerprefname}_viewer_selection_restrictions"}= "WHERE `username` = '$PREF{logged_in_username}'";
	}
	if(!$allowed_to_edit   &&   $PREF{groups_allowed_to_edit_alt_upload_log_db} =~ /(^|,)\s*self\s*(,|$)/   &&   $PREF{member_is_logged_in}   &&   $PREF{logged_in_username})
	{
		# Same for "edit".
		#
		$allowed_to_edit = 1;
		$PREF{"${viewerprefname}_editmode_restrictions"}	= "AND `username` = '$PREF{logged_in_username}'";
	}
	if(!$allowed_to_delete   &&   $PREF{groups_allowed_to_delete_alt_upload_log_db_records} =~ /(^|,)\s*self\s*(,|$)/   &&   $PREF{member_is_logged_in}   &&   $PREF{logged_in_username})
	{
		# Same for "delete".
		#
		$allowed_to_delete = 1;
		$PREF{"${viewerprefname}_editmode_restrictions"}	= "AND `username` = '$PREF{logged_in_username}'";
	}


	# Nothing below here should need to be edited in most cases:
	#
	# Call get_database_data() before starting any output in case we were POSTed
	# to and therefore we need to redirect instead of printing output.
	#
	my $output = get_database_data($tableprefname, $viewerprefname, $allowed_to_view, $allowed_to_create, $allowed_to_edit, $allowed_to_delete);
	start_html_output($PREF{"${viewerprefname}_viewer_title"});
	print $output;
	finish_html_output();
}


sub show_download_log
{
	$PREF{on_a_wide_page} = 1;

	my $tableprefname	= 'download_log_table';
	my $viewerprefname	= 'download_log';
	my $allowed_to_view	= user_is_allowed_to('view_download_log_db');
	my $allowed_to_create	= 0;
	my $allowed_to_edit	= user_is_allowed_to('edit_download_log_db');
	my $allowed_to_delete	= user_is_allowed_to('delete_download_log_db_records');



	exit_with_error("This feature is disabled.") unless $PREF{log_all_downloads} =~ /yes/i;

	$PREF{"${viewerprefname}_viewer_value_transforms"}{size}	= qq`%%variable%% = format_filesize_nicely(%%variable%%);`;



	# Nothing below here should need to be edited in most cases:
	#
	# Call get_database_data() before starting any output in case we were POSTed
	# to and therefore we need to redirect instead of printing output.
	#
	my $output = get_database_data($tableprefname, $viewerprefname, $allowed_to_view, $allowed_to_create, $allowed_to_edit, $allowed_to_delete);
	start_html_output($PREF{"${viewerprefname}_viewer_title"});
	print $output;
	finish_html_output();
}


sub show_administration_menu
{
	exit_with_needprivs() unless user_is_allowed_to('view_administration_page');

	my $i = 0;
	my $links = '';
	$links .= qq`<a class="` . oddeven($i) . qq`" href="$PREF{here_qsready}action=help">$TEXT{Help}</a>`;
	$links .= qq`<a class="` . oddeven($i) . qq`" href="$PREF{here_qsready}action=config">$TEXT{Configuration}</a>`;
	$links .= qq`<a class="` . oddeven($i) . qq`" href="$PREF{here_qsready}action=showprefs">Show All Prefs</a>`			if user_is_allowed_to('view_administration_page');
	$links .= qq`<a class="` . oddeven($i) . qq`" href="$PREF{here_qsready}action=serverinfo">$TEXT{Server_Information}</a>`;
	$links .= qq`<a class="` . oddeven($i) . qq`" href="$PREF{here_qsready}action=imagemodules">$TEXT{Check_Image_Modules}</a>`;
	$links .= qq`<a class="` . oddeven($i) . qq`" href="$PREF{here_qsready}action=uploadlog">$TEXT{View_Upload_Log}</a>`		if user_is_allowed_to('view_upload_log_db') && $PREF{store_upload_info_in_database} =~ /yes/i;
	$links .= qq`<a class="` . oddeven($i) . qq`" href="$PREF{here_qsready}action=downloadlog">$TEXT{View_Download_Log}</a>`	if user_is_allowed_to('view_download_log_db') && $PREF{log_all_downloads} =~ /yes/i;

	foreach my $link (@{$PREF{extra_administration_links}})
	{
		my $oddeven = oddeven($i);
		$link =~ s!<a !<a class="$oddeven" !;
		$links .= $link;
	}

	my $menu = $PREF{administration_template};
	$menu =~ s/%%links%%/$links/g;
	start_html_output($TEXT{Administration});
	print $menu;
	print qq`<p class="admin_footnote version_info">This is FileChucker version $version.&nbsp; View <a href="http://encodable.com/filechucker/#changelog">the changelog</a> for details.</p>\n`;
	print qq`<p class="admin_footnote">Like FileChucker?&nbsp; Check out our other apps, like <a href="http://encodable.com/userbase/">UserBase</a> for login &amp; account management, and <a href="http://encodable.com/visitorlog/">VisitorLog</a> for statistics &amp; real-time traffic logging.</p>\n`;
	finish_html_output();
}


sub show_help
{
	start_html_output($TEXT{Help});
	print qq`
		<div style="text-align: left;">
		<p>
		For help with installation issues, you should read the
		<a href="http://encodable.com/filechucker/#instructions">full installation instructions</a>.&nbsp; 
		They contain details for Linux/Unix/OS X servers as well as Windows servers.
		</p>
		<p>
		For help with configuration issues (and some installation issues)
		you should <a href="http://encodable.com/filechucker/faq/">read the FAQ</a>.
		</p>
		</div>
	`;
	finish_html_output();
}


sub show_configuration
{
	start_html_output($TEXT{Configuration});
	print qq`
		<div style="text-align: left;">
		<p>
		To configure FileChucker, just edit your filechucker_prefs.cgi file.&nbsp; By default
		this is in the same directory as your filechucker.cgi file, which is usually the
		"cgi-bin" directory.&nbsp; See <a href="http://encodable.com/filechucker/faq/#custom">this
		FAQ item</a> for more details.
		</p>
		</div>
	`;
	finish_html_output();
}


sub show_sale_options___old
{
	# This version of show_sale_options() has never been live; it was coded (but never quite
	# finished) before CornerStore went live, and it's based on the idea of specifying all
	# the item options (including price, etc) within FileChucker, and then passing those to
	# CornerStore (in a tamper-proof way) to add the item to the cart.  We may still add this
	# capability, but at least initially, we're going with a different approach where the
	# only information specified in FileChucker is which already-existing CornerStore item
	# each file/folder in FileChucker corresponds to.

	exit_with_error("In development.");
	
	my $tableprefname	= 'file_and_dir_info_table';
	my $viewerprefname	= 'saleoptions';
	my $allowed_to_view	= user_is_allowed_to('view_sale_options_db');
	my $allowed_to_create	= user_is_allowed_to('create_sale_options_db_records');
	my $allowed_to_edit	= user_is_allowed_to('edit_sale_options_db');
	my $allowed_to_delete	= user_is_allowed_to('delete_sale_options_db_records');



	exit_with_error("This feature is disabled.") unless $PREF{enable_selling} =~ /yes/i;

	$PREF{saleoptions_viewer_title}				||= 'Sale Options';
	$PREF{saleoptions_viewer_hidden_columns}		||= 'id';
	$PREF{saleoptions_viewer_disabled_columns}		||= '';
	$PREF{saleoptions_viewer_max_display_length}		||= 20;
	$PREF{saleoptions_viewer_itemsperpage}			||= 25;

	$PREF{saleoptions_viewer_template}			||= qq`<h2>Sale Options</h2>\n<br />
		<p style="text-align: left;">
			Notes: "Path" must include at least a directory (even if it's just "/") and may optionally include a filename.
			<br /><br />When a file matches multiple records here, the most specific one is the one that applies, so you can for example set a base price for "/" and then set more specific prices on a per-folder and/or per-file basis.
		</p>
		<p>[ %%horizlink:text=Horizontal%% | %%vertlink:text=Vertical%% %%%if-viewall%%% | %%viewalllink:text=View All%% %%%end-viewall%%% ]</p>
		<p>%%pagelinks%%</p>\n\n<br />\n%%output%%\n<p>%%pagelinks%%</p>
	`;

	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_name}		= qq`Item name`;
	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_code}		= qq`Item code`;
	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_description}	= qq`Item description`;
	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_options}	= qq`Item options`;
	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_price}		= qq`Item price`;



	$PREF{"${viewerprefname}_POST_value_transforms"}{sellable_item_price}		= qq`%%variable%% =~ s![^\\d\\.]!!g;`; # allow only digits and dots.






	# Nothing below here should need to be edited in most cases:
	#
	# Call get_database_data() before starting any output in case we were POSTed
	# to and therefore we need to redirect instead of printing output.
	#
	my $output = get_database_data($tableprefname, $viewerprefname, $allowed_to_view, $allowed_to_create, $allowed_to_edit, $allowed_to_delete);
	start_html_output($PREF{"${viewerprefname}_viewer_title"});
	print $output;
	finish_html_output();
}


sub show_sale_options
{
	my $tableprefname	= 'file_and_dir_info_table';
	my $viewerprefname	= 'saleoptions';
	my $allowed_to_view	= user_is_allowed_to('view_buy_links_db');
	my $allowed_to_create	= user_is_allowed_to('create_buy_links');
	my $allowed_to_edit	= user_is_allowed_to('edit_buy_links');
	my $allowed_to_delete	= user_is_allowed_to('delete_buy_links');



	exit_with_error("This feature is disabled.") unless cornerstore_integration_enabled();

	$PREF{"${viewerprefname}_viewer_title"}			= "Add a Buy Link";
	$PREF{"${viewerprefname}_viewer_item_name"}		= "Buy Link";
	$PREF{saleoptions_viewer_hidden_columns}		||= 'id';



	# The URL passed here will contain either file= or folder=.
	my $path = get_qs_var('basepath') || '/';
	my $file = get_qs_var('file');
	my $folder = get_qs_var('folder');
	my $is_file = $file ? 1 : 0;


	if(!get_qs_var('basepath') && $qs =~ /editmode=true&editid=(\d+)/)
	{
		my $record_id = $1;
		$path = enc_sql_select("SELECT `path` FROM `$PREF{$tableprefname}` WHERE `id` = $record_id");
		encdebug "path=$path for record ID $record_id";

		# If the path doesn't end in a slash, then it's a file (not a folder), so set $file and adjust $path accordingly:
		#
		if($path =~ m!^(.+?)([^/]+)$!)
		{
			#($path,$file) = ($1,$2);
			$is_file = 1;
		}
	}


	my $item = "/$path/$folder/$file"; slashify($item); $item =~ s!/$!!g if $file;
	my $itemtype = $file ? 'file' : 'folder';



	$PREF{"${viewerprefname}_viewer_title_transforms"}{path}			= $is_file ? 'File' : 'Folder';
	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_context}	= qq`Show this buy link for`;
	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_linktext}	= qq`Text for this buy link`;
	$PREF{"${viewerprefname}_viewer_title_transforms"}{sellable_item_code}		= qq`CornerStore item to buy`;


	$PREF{"${viewerprefname}_creation_default_value"}{path}				= $item;
	$PREF{"${viewerprefname}_readonly_value__still_submitted"}{path}		= 1;
	$PREF{"${viewerprefname}_creation_complete_redirection_url"}			= decode_origref();

	$PREF{"${viewerprefname}_viewer_column_is_predefined_list"}{sellable_item_context} = "0///This folder itself|||1///Each file within this folder|||";
	#$PREF{"${viewerprefname}_input_notes_for_vertmode_col_header"}{sellable_item_context} = qq`only applies for folders`;

	$PREF{"${viewerprefname}_viewer_value_transforms"}{sellable_item_context}	= qq`%%variable%% = 'This file' if "%%path%%" !~ m!/\$!;`;




	# Remove these from the redirect URL, so that the db viewer page (which is shown after
	# a new item is created) doesn't interpret them as restrictions (filters/searches) on
	# the displayed data, which would hide some/most of it.  Update: actually, let's just
	# rename the passed URL variable from "path" to "basepath" so it doesn't match the name
	# of the "path" column in the database; that's a cleaner solution.  And also, in this
	# case, we actually DO want these same variables to remain on the URL for any additional
	# clicks on the add-new-record link, because we never want the "Show this buy link for"
	# field to be empty -- it should always be a drop-down showing options.  Further update:
	# but leaving those on the URL causes the edit links to break.
	#
	$PREF{"${viewerprefname}_vars_to_remove_from_redirect_URL"}			= { basepath => 1, file => 1, folder => 1 };



	my $cornerstore_item_table = '';
	foreach my $table(split(/\s*,\s*/, $PREF{cornerstore_item_table_list}))
	{
		# This pref contains the full-version table name and the trial version table name,
		# so that we can support both without any extra hassle.

		if(db_table_exists($table))
		{
			$cornerstore_item_table = $table;
			last;
		}
	}
	die_unless_sqlsafe($cornerstore_item_table);
	my $itemdata = enc_sql_select_multi("SELECT `name`,`code` FROM `$cornerstore_item_table` WHERE `option1name` != '' ORDER BY `code`");
	foreach my $k (sort { $a <=> $b } keys %$itemdata)
	{
		$PREF{"${viewerprefname}_viewer_column_is_predefined_list"}{sellable_item_code} .= "$$itemdata{$k}{code}///$$itemdata{$k}{code} - $$itemdata{$k}{name}|||";
	}




	# The file_and_dir_info_table can (eventually will) contain many columns related to many
	# different features, but for the purposes of this sub, we only want to show/edit the
	# relevant ones.  So set all the rest to disabled.
	#
	my $fields_in_this_table = get_db_colnames($PREF{$tableprefname});
	$fields_in_this_table =~ s!(^|,)(path|sellable_item_code|sellable_item_linktext|sellable_item_context)(,|$)!$1$3!g while $fields_in_this_table =~ m!(^|,)(path|sellable_item_code|sellable_item_linktext|sellable_item_context)(,|$)!;
	decommaify($fields_in_this_table);
	$PREF{saleoptions_viewer_disabled_columns} = $fields_in_this_table;
	#
	# Also, hide the sellable_item_context field when the item in question is a file rather
	# than a folder:
	#
	$PREF{saleoptions_viewer_disabled_columns} .= ',sellable_item_context' if $is_file;





	# Nothing below here should need to be edited in most cases:
	#
	# Call get_database_data() before starting any output in case we were POSTed
	# to and therefore we need to redirect instead of printing output.
	#
	my $output = get_database_data($tableprefname, $viewerprefname, $allowed_to_view, $allowed_to_create, $allowed_to_edit, $allowed_to_delete);
	start_html_output($PREF{"${viewerprefname}_viewer_title"});
	print $output;
	finish_html_output();
}


sub get_buy_details
{
	return {} unless cornerstore_integration_enabled();

	my $optsref = shift; my %opts = %$optsref if $optsref;

	die_unless_sqlsafe($opts{path});
	die_unless_sqlsafe($opts{file}) if $opts{file};
	slashify($opts{path});
	my $fullpath = $opts{path} . $opts{file};
	my $justpath = $opts{path};

	my %buy_details = ();

	my @links = ();
	my $items = enc_sql_select_multi("SELECT `sellable_item_context`,`sellable_item_linktext`,`sellable_item_code` FROM `$PREF{file_and_dir_info_table}` WHERE `path` = '$fullpath' AND `sellable_item_context` = 0");
	foreach my $i (sort keys %$items)
	{
		# We may add support for this approach in the future:
		#
		#my $fingerprint = get_cart_item_fingerprint(
		#			$$items{$i}{sellable_item_name},
		#			$$items{$i}{sellable_item_code},
		#			$$items{$i}{sellable_item_description},
		#			$$items{$i}{sellable_item_options},
		#			$$items{$i}{sellable_item_price}
		#);
		#
		#$buy_details{link_html} = '????';

		my $link = $PREF{cornerstore_buy_link};
		$link =~ s!%%itemcode%%!$$items{$i}{sellable_item_code}!g;
		$link =~ s!%%linktext%%!$$items{$i}{sellable_item_linktext}!g;
		$link =~ s!%%file_or_folder_path%%!$fullpath!g;
		push @links, $link;
	}

	my @parent_folders = split(/\//, $justpath);
	unshift @parent_folders, '/';
	foreach my $parent_folder (@parent_folders)
	{
		slashify($parent_folder);
		my $items = enc_sql_select_multi("SELECT `sellable_item_context`,`sellable_item_linktext`,`sellable_item_code` FROM `$PREF{file_and_dir_info_table}` WHERE `path` = '$parent_folder' AND `sellable_item_context` = 1");
		foreach my $i (sort keys %$items)
		{
			my $link = $PREF{cornerstore_buy_link};
			$link =~ s!%%itemcode%%!$$items{$i}{sellable_item_code}!g;
			$link =~ s!%%linktext%%!$$items{$i}{sellable_item_linktext}!g;
			$link =~ s!%%file_or_folder_path%%!$fullpath!g;
			push @links, $link;
		}
	}

	$buy_details{link_html} = join($PREF{cornerstore_buy_link_separator}, @links);

	return \%buy_details;
}


sub show_link_to_filelist
{
	# The uploaded_files_urlpath must exist (i.e. uploaded_files_dir either must be
	# in the DOCROOT or else the webmaster must have set uploaded_files_urlpath
	# explicitly), or download_links_go_through_FileChucker must be set; and the
	# user must have permission to view_download_page.
	return
	(

		(
			$PREF{uploaded_files_urlpath}
		||
			$PREF{download_links_go_through_FileChucker} =~ /yes/i
		)

	&&

		user_is_allowed_to('view_download_page')

	);
}


sub interpolate_vars_from_formfields
{
	# This sub has 2 mandatory parameters and 1 optional one:
	#
	# 1: the formfields hashref (mandatory);
	# 2: the variable to interpolate the values into (mandatory);
	# 3: the which-file-is-this $h variable, for perfile fields (optional).

	my $formfields = $_[0]; # hashref
	my $h = $_[2];

	while($_[1] =~ /(%FIELD\{(\w+)\})/g)
	{
		my ($to_replace, $shortname)	= ($1, $2);
		my $formfield_key		= get_formfield_key_from_shortname($shortname);
		my $replacement = exists $$formfields{$formfield_key} ? $$formfields{$formfield_key}{value} : $$formfields{"${formfield_key}_$h"}{value}; # the latter is for perfile formfields.
		$_[1] =~ s/$to_replace/$replacement/;
	}
}


# The string returned by this function must end with an ampersand (unless it's null).
sub get_userdir_for_qs
{
	my $userdir = $PREF{enable_userdirs} =~ /yes/i && $PREF{enable_userdir_on_url} =~ /yes/i ? $PREF{userdir} : '';
	$userdir = "userdir=$userdir&" if $userdir;
	return $userdir;
}


# The string returned by this function must end with an ampersand (unless it's null).
sub get_path_and_userdir_for_qs
{
	my $userdir = get_userdir_for_qs();
	my ($path) = ($qs =~ /(?:^|&)path=(.*?)(?:&|$)/);

	my $output = ();
	$output .= $userdir if $userdir;
	$output .= "path=$path&" if $path;
	return $output;
}


sub get_textboxes
{
	my $position = shift;
	my $i = shift; # if present, then we're dealing with perfile textboxes.

	my $enabled = 0;
	my $output = '';

	my ($path, $file, $num_files_selected) = ();
	if($PREF{in_reprocessing_mode}) # redundant (with the inner if()) for clarity.
	{
		if($qs =~ /(?:^|&)path=(.*?)&ffs1=file-(.+?)(?:&|$)/)
		{
			($path, $file) = ($1, $2);
			$path = '/' unless $path;
			enc_urldecode($path, $file);
			slashify($path);
			$path = enc_untaint($path, 'keep_path');
			$file = enc_untaint($file);
			sql_untaint($path, $file);
		}
		foreach my $arg (split(/&/, $qs))
		{
			$num_files_selected++ if $arg =~ /^ffs\d+=file-.+/;
		}
	}

	foreach my $textbox (get_textbox_pref_keys($position))
	{
		my ($num) = ($textbox =~ /^formfield_(\d+)$/);
		$enabled = 1;

		my $shortname = $PREF{"${textbox}_shortname"};
		my $presetvalue = $PREF{"${textbox}_default"};

		if((my $savedvalue = get_cookie($shortname))   &&   $PREF{"${textbox}_save"} =~ /yes/i)
		{
			$presetvalue = $savedvalue unless $PREF{default_formfield_value_overrides_value_from_cookie} =~ /yes/i;
		}

		if($PREF{"${textbox}_only_for_these_groups"} =~ /(.+)/)
		{
			my $grouplist = $1;
			my $show = 0;
			foreach my $group (split(/\s*,\s*/, $grouplist))
			{
				$show = 1 if user_is_member_of_group($PREF{logged_in_userid}, $group);
			}
			next unless $show;
		}

		my (%reprocessing_options,$readonly) = ();
		if($PREF{in_reprocessing_mode})
		{
			%reprocessing_options = map { $_ => 1 } split(/\s*,\s*/, $PREF{"${textbox}_reprocessing"});
			next if $reprocessing_options{skip};

			if($reprocessing_options{refill})
			{
				my $shortname = $PREF{"${textbox}_shortname"};
				exit_with_error("$PREF{internal_appname}: you didn't set a _shortname PREF for the $textbox textbox.") unless $shortname;
				sql_untaint($shortname);
				# $path and $file are sql_untaint()'ed outside the foreach() loop.
				my $value = enc_sql_select("SELECT `$shortname` FROM `$PREF{upload_log_table}` WHERE `filepath` = '$path' AND `filename` = '$file';");
				$presetvalue = $value if $value;
			}

			$readonly = qq`readonly="readonly"` if $reprocessing_options{readonly};
			$presetvalue = $num_files_selected if $reprocessing_options{fill_with_num_files_selected};
		}

		if($PREF{"${textbox}_before"} =~ /\S/)	{ $output .= $PREF{"${textbox}_before"}; }

		my $name = $i ? "${shortname}_$i" : $shortname;
		my $displayname = $PREF{"${textbox}_displayname"} || $PREF{$textbox};

		my $required	= $PREF{"${textbox}_required"}	=~ /yes/i ? ' required' : '';
		my $emailformat	= $PREF{"${textbox}_email"}	=~ /yes/i ? ' emailformat' : '';
		my $numeric	= $PREF{"${textbox}_numeric"}	=~ /yes/i ? ' numeric' : '';
		my $alphabetic	= $PREF{"${textbox}_alphabetic"}=~ /yes/i ? ' alphabetic' : '';
		my $alphanum	= $PREF{"${textbox}_alphanum"}	=~ /yes/i ? ' alphanum' : '';
		my $password	= $PREF{"${textbox}_password"}	=~ /yes/i ? ' encnewpw' : '';
		my $datepicker	= $PREF{"${textbox}_datepicker"}=~ /yes/i ? ' encdatepicker_field' : '';

		$readonly = 'readonly="readonly"' if $PREF{"${textbox}_readonly"} =~ /yes/i;

		if($PREF{"${textbox}_custom"} =~ /yes/i)
		{
			# don't print the element here, because the user is defining it himself via the custom form prefs.
		}
		elsif($PREF{"${textbox}_dropdown"} =~ /\S/)
		{
			$output .= qq`<div class="fcfieldwrap clearfixtb $textbox fcdropdown"><label class="upform_label">$displayname</label>`;
			$output .= qq`<select name="$name" id="formfield-$name" class="upform_field $textbox$required" $readonly>`;

			if($PREF{"${textbox}_dropdown"} =~ /^SELECT `/)
			{
				# start it with a null value so that the _required option works.
				$output .= qq`<option value=""></option>`;

				my $statement = $PREF{"${textbox}_dropdown"};
				$output .= generate_dropdown_from_sql($statement, $presetvalue);
			}
			else
			{
				my @options = $PREF{"${textbox}_dropdown"} =~ /\|\|\|/ ? split(/\|\|\|/, $PREF{"${textbox}_dropdown"}) : split(/[\r\n]+/, $PREF{"${textbox}_dropdown"});
				my @option_values = $PREF{"${textbox}_dropdown_values"} =~ /\|\|\|/ ? split(/\|\|\|/, $PREF{"${textbox}_dropdown_values"}) : split(/[\r\n]+/, $PREF{"${textbox}_dropdown_values"});
				my $j = 0;
				foreach my $option (@options)
				{
					my $option_value = $option_values[$j] ? $option_values[$j] : $option;
					$output .= qq`<option value="$option_value"` . ($option_value eq $presetvalue ? ' selected="selected"' : undef) . qq`>$option</option>`;
					$j++;
				}
			}

			$output .= qq`</select>`;
			$output .= qq`</div>\n`;
		}
		elsif($PREF{"${textbox}_checkbox"} =~ /\S/)
		{
			my $template = $PREF{"${textbox}_template"} || $PREF{formfield_template___checkbox};
			my $checked = $presetvalue =~ /on/i;
			$template =~ s!%%prefname%%!$textbox!g;
			$template =~ s!%%display_name%%!$displayname!g;
			$template =~ s!%%name%%!$name!g;
			$template =~ s!%%readonly%%!$readonly!g;
			$template =~ s!%%checked%%!$checked ? 'checked="checked"' : ''!eg;
			$template =~ s!%%prefname%%!$textbox!g;
			$template =~ s!%%required%%!$required!g;

			$output .= $template;
		}
		elsif($PREF{"${textbox}_radio"} =~ /yes/i)
		{
			my $template = $PREF{"${textbox}_template"} || $PREF{formfield_template___radio};
			$template =~ s!%%prefname%%!$textbox!g;
			$template =~ s!%%display_name%%!$displayname!g;

			my $checked_i = 1;
			my @buttons = ();
			foreach my $pref (sort keys %PREF)
			{
				if($pref =~ /^${textbox}_option(\d+)_value$/)
				{
					my $option_i = $1;
					my $value = $PREF{"${textbox}_option${option_i}_value"};
					my $label = $PREF{"${textbox}_option${option_i}_label"};
					my $checked = (($value eq $presetvalue) || ($checked_i == 1 && $PREF{check_first_radio_button} =~ /yes/i));
					my $button_template = $PREF{formfield_template___radio___buttons};
					$button_template =~ s!%%name%%!$name!g;
					$button_template =~ s!%%value%%!$value!g;
					$button_template =~ s!%%label%%!$label!g;
					$button_template =~ s!%%readonly%%!$readonly!g;
					$button_template =~ s!%%checked%%!$checked ? 'checked="checked"' : ''!eg;
					$button_template =~ s!%%prefname%%!$textbox!g;
					$button_template =~ s!%%required%%!$required!g;
					push @buttons, $button_template;
					$checked_i++;
				}
			}
			$template =~ s!%%radio_buttons%%!join $PREF{"${textbox}_item_separator"}, @buttons!egs;

			$output .= $template;
		}
		elsif($PREF{"${textbox}_hidden"} =~ /\S/)
		{
			$output .= qq`<input type="hidden" name="$name" id="formfield-$name" class="$textbox" value="$presetvalue" />\n`;
		}
		elsif($PREF{"${textbox}_multiline"} =~ /yes/i)
		{
			my $template = $PREF{"${textbox}_template"} || $PREF{formfield_template___multiline};
			$template =~ s!%%display_name%%!$displayname!g;
			$template =~ s!%%prefname%%!$textbox!g;
			$template =~ s!%%name%%!$name!g;
			$template =~ s!%%presetvalue%%!$presetvalue!g;
			$template =~ s!%%required%%!$required!g;
			$template =~ s!%%readonly%%!$readonly!g;
			$output .= $template;
		}
		else
		{
			if($reprocessing_options{hide})
			{
				$output .= qq`<input type="hidden" name="$name" id="formfield-$name" value="$presetvalue" />\n`;
			}
			else
			{
				my $type = $password ? 'password' : 'text';

				my $template = $PREF{"${textbox}_template"} || $PREF{formfield_template___text};
				$template =~ s!%%display_name%%!$displayname!g;
				$template =~ s!%%prefname%%!$textbox!g;
				$template =~ s!%%name%%!$name!g;
				$template =~ s!%%type%%!$type!g;
				$template =~ s!%%presetvalue%%!$presetvalue!g;
				$template =~ s!%%required%%!$required!g;
				$template =~ s!%%emailformat%%!$emailformat!g;
				$template =~ s!%%numeric%%!$numeric!g;
				$template =~ s!%%alphabetic%%!$alphabetic!g;
				$template =~ s!%%alphanum%%!$alphanum!g;
				$template =~ s!%%password%%!$password!g;
				$template =~ s!%%readonly%%!$readonly!g;
				$template =~ s!%%datepicker%%!$datepicker!g;

				if($datepicker)
				{
					$template =~ s!%%onclick%%!onclick="show_datepicker(this.id)"!;
				}
				else
				{
					$template =~ s!%%onclick%%!!;
				}

				$output .= $template;
			}
		}

		if($PREF{"${textbox}_after"} =~ /\S/)	{ $output .= $PREF{"${textbox}_after"}; }
	}

	my $textboxes = ();
	if($enabled && $output)
	{
		$textboxes = qq`<div id="${position}-textboxes" class="clearfixtb">\n`;
		$textboxes .= qq`\t<div id="${position}-textboxes-title">$PREF{"${position}_formfields_title"}</div>\n` if $PREF{"${position}_formfields_title"} =~ /\S/;

		if($PREF{in_replace_mode})
		{
			$textboxes .= qq`<p><i>In Replace Mode; using existing values.</i></p>\n`;
		}
		if($PREF{in_addfile_mode})
		{
			$textboxes .= qq`<p><i>In AddFile Mode; using existing values.</i></p>\n`;
		}
		else
		{
			$textboxes .= $output;
		}

		$textboxes .= qq`</div>\n\n\n`;

		return $textboxes;
	}
	else
	{
		return undef;
	}
}


# This is for use with either our built-in formfield prefs or the
# custom formfield settings; either way, the $statement must be
# in the format defined in PREFs Section 07.
#
sub generate_dropdown_from_sql
{
	my ($statement, $presetvalue) = @_;
	my $output = '';

	my ($fieldnames) = ($statement =~ /^SELECT `([\w`,]+)` FROM/i);
	my $field1 = my $field2 = '';
	if($fieldnames =~ /,/)
	{
		($field1,$field2) = ($fieldnames =~ /(\w+)`,`(\w+)/i);
	}
	else { $field1 = $fieldnames; }

	# no SQL sanitizing here because the site-owner himself is creating this statement.
	my $options = enc_sql_select_multi($statement);
	foreach my $k (sort keys %$options)
	{
		my $option_value = $$options{$k}{$field2} ? $$options{$k}{$field2} : $$options{$k}{$field1};
		$output .= qq`<option value="$option_value"` . ($option_value eq $presetvalue ? ' selected="selected"' : undef) . qq`>$$options{$k}{$field1}</option>`;
	}

	return $output;
}


sub process_custom_form_fields_code($)
{
	my $code = shift;
	interpolate_vars_from_URL_and_cookies('include_undefined', $code);
	interpolate_vars_from_prefs($code);
	while($code =~ /(%%dropdown_from_sql:(.+?)%%)/g)
	{
		my ($wholething, $statement) = ($1,$2);
		my $output = generate_dropdown_from_sql($statement);
		$code =~ s!$wholething!$output!;
	}
	return $code;
}


sub get_textbox_values_for_qs
{
	my $textboxes = shift; # hashref.
	my $output = '';

	foreach my $location ('top', 'perfile', 'bottom')
	{
		if($PREF{"${location}_formfields_title"} =~ /\S/)
		{
			my $title = $PREF{"${location}_formfields_title"};
			enc_urlencode($title);
			$output .= qq`${location}_ff_title=$title&`;
		}
		foreach my $tb (sort keys %$textboxes)
		{
			my ($tbname,$filenum) = ($tb =~ /^(.+)_(\d+)$/);
			if(
				 (   ($tb =~ /^formfield_\w+$/ && $PREF{"${tb}_position"} eq $location)   )

				||

				 (   (($tb =~ /^formfield_\w+_\d+$/ && $PREF{"${tbname}_position"} eq $location)   )   )
			)
			{
				my $tb_key_short = $tb;
				$tb_key_short =~ s/formfield_/ff/; # turn "formfield_01" into "ff01".

				unless($PREF{hide_formfield_names_on_redirection_qs} =~ /yes/i)
				{
					my $name = $$textboxes{$tb}{name};
					enc_urlencode($name);
					$output .= qq`${tb_key_short}n=$name&`;
				}

				my $value = $$textboxes{$tb}{value};
				#if($PREF{"${tb}_checkbox"} =~ /yes/i) { $value = $value =~ /^(on|yes|checked|1)$/i ? 'yes' : 'no'; } # this probably doesn't belong here.
				enc_urlencode($value);
				$output .= qq`${tb_key_short}v=$value&`;
			}
		}
	}

	$output =~ s/&+$//;
	return $output;
}


sub get_textbox_pref_keys()
{
	my %keys = ();
	foreach my $location (@_)
	{
		foreach my $key (keys %PREF)
		{
			if($key =~ /^formfield_(\d+)$/)
			{
				$keys{$1} = $key if ($PREF{"${key}_position"} eq $location);
			}
		}
	}

	my @keys = ();
	foreach my $num (sort { $a <=> $b } keys %keys)
	{
		push @keys, $keys{$num};
	}

	return @keys;
}


sub get_formfield_key_from_shortname($)
{
	my $shortname = shift;
	foreach my $key (keys %PREF)
	{
		if($key =~ /^(formfield_\w+)_shortname$/   &&   $PREF{$key} eq $shortname)
		{
			return $1;
		}
	}

	#exit_with_error("Error: get_formfield_key_from_shortname('$shortname'): no key has that shortname.\n");
	enc_warn "Error: get_formfield_key_from_shortname('$shortname'): no key has that shortname.\n";
}


sub show_download_landing_page
{
	exit_with_access_denied() unless user_is_allowed_to('download');

	my $path = shift || '/';
	my $file = shift;
	my $extra_message = shift;

	enc_urldecode($path, $file);

	$file = enc_untaint($file);
	$path = enc_untaint($path, 'keep_path') if $path;

	exit_with_error($TEXT{Insufficient_permissions_to_download_file_}) unless folder_perms_allow_reading($path);

	my $fullfile = "$PREF{uploaded_files_realpath}/$path/$file";
	condense_slashes('leave_leading_UNC', $fullfile);

	my $url = get_download_link('landing_page', $path, $file);

	my $template = $PREF{landing_page_template};
	$template =~ s!%%url%%!$url!g;
	$template =~ s!%%filename%%!$file!g;
	$template =~ s!%%extra_message%%!$extra_message!g;
	$template =~ s!%%size%%!format_filesize_nicely(-s $fullfile)!eg;
	if($template =~ /%FIELD/)
	{
		die_unless_sqlsafe($path, $file);
		$template =~ s!%FIELD\{(\w+)\}!enc_sql_select("SELECT `$1` FROM `$PREF{upload_log_table}` WHERE `filepath`='$path' AND `filename`='$file'")!eg;
	}

	if($template =~ m!(%%%delay-wrapper%%%(.+?)%%%end-delay-wrapper%%%)!s)
	{
		my ($wholething, $downloadlink) = ($1, $2);
		if($PREF{landing_page_delay}   &&   $PREF{landing_page_delay} =~ /^\d+$/)
		{
			$PREF{landing_page_wait_message} =~ s!%%delay%%!<span id="fcdownloaddelaytimer">$PREF{landing_page_delay}</span>!g;
			$template =~ s!\Q$wholething\E!$PREF{landing_page_wait_message}<div id="fcdownloadlinkdelayed" style="display:none;">$downloadlink</div>!g;
		}
		else
		{
			$template =~ s!\Q$wholething\E!<div id="fcdownloadlinkdelayed">$downloadlink</div>!g;
		}
	}

	start_html_output($PREF{landing_page_title});
	print $template;
	finish_html_output();
}


sub download_file
{
	exit_with_access_denied() unless user_is_allowed_to('download');
	my $optsref = shift; my %options = %$optsref if $optsref;

	my $path = exists $options{passed_path} ? $options{passed_path} : get_qs_var('path');
	my $file = exists $options{passed_file} ? $options{passed_file} : get_qs_var('file');
	my $path_is_absolute = $options{path_is_absolute};
	my $inline = $options{inline};

	$file = enc_untaint($file);
	$path = enc_untaint($path, 'keep_path') if $path;
	$path = "/$path" unless $path =~ m!^(/|\\|\w:[/\\])!;

	exit_with_error($TEXT{Insufficient_permissions_to_download_file_}) unless folder_perms_allow_reading($path);

	if($PREF{hotlink_whitelist})
	{
		my $allowed = 0;
		foreach my $num (keys %{$PREF{hotlink_whitelist}})
		{
			my $domain = $PREF{hotlink_whitelist}{$num};
			$allowed = 1 if $ENV{HTTP_REFERER} =~ m!^https?://(www\.)?$domain/!;
		}
		exit_with_error($TEXT{No_hotlinking_}) unless $allowed;
	}

	my $fullfile = $path_is_absolute ? "$path/$file" : "$PREF{uploaded_files_realpath}/$path/$file";
	condense_slashes('leave_leading_UNC', $fullfile);
	exit_with_error("That file does not exist.") unless -f $fullfile;
	exit_with_error("That file is a blank/empty file; there's nothing to download.") unless -s $fullfile;

	# If an admin is logged in, skip this test; the admin doesn't need to provide the password.
	#
	if(!$PREF{admin_is_logged_in}   &&   ($PREF{enable_perfile_passwords} =~ /yes/i)   &&   (my $hashed_filepw = get_file_metadata($path,$file,'filepw')))
	{
		if($ENV{REQUEST_METHOD} =~ /post/i)
		{
			my $entered_password = md5_hex(param('password'));
			exit_with_error($TEXT{filepw_access_denied}) unless $entered_password eq $hashed_filepw;
		}
		else
		{
			start_html_output($TEXT{Password_Required});
			print	  qq`<form method="post" action="$ENV{SCRIPT_NAME}?$qs">`
				. qq`\n$TEXT{Enter_password_for_file}`
				. qq`\n<br /><br /><input type="password" name="password" maxlength="200" class="default text" />`
				. qq`\n<br /><br /><input type="submit" value="$TEXT{filepw_button_label}" class="default button submit" />`
				. qq`\n</form>`
				. qq`\n`;
			finish_html_output();
			exit;
		}
	}

	select STDOUT;
	$| = 1;

	my ($read,$buf) = ();
	my $size = (stat $fullfile)[7];

	my $content_type = '';
	my $ext = lc(($file =~ /\.([^\.]+)$/)[0]);
	eval { require MIME::Types; }; $PREF{MIME_Types_error} = $@;
	if($PREF{MIME_Types_error} || $PREF{dont_use_the_mime_types_module} =~ /yes/i)
	{
		$content_type = $PREF{"mimetype_for_${ext}"};
	}
	else
	{
		my $mimetypes = MIME::Types->new;
		#my MIME::Type $the_type = $mimetypes->mimeTypeOf($ext);
		my $the_type = $mimetypes->mimeTypeOf($ext);
		$content_type = $the_type;
	}
	$content_type ||= 'application/octet-stream';

	my $disposition = $inline && $content_type ne 'application/octet-stream' ? 'inline' : 'attachment';

	print	  qq`Content-Type: $content_type\n`
		#. ($disposition eq 'attachment' ? qq`Content-Disposition: $disposition; filename="$file"\n` : '')
		. qq`Content-Disposition: $disposition; filename="$file"\n`
		. qq`Content-Length: $size\n`
		#. qq`Content-Description: Downloadable File\n`
		. qq`\n`;

	open(DOWNLOADFILEFH, $fullfile) or die "$0: couldn't open file '$fullfile' for reading: $!\n";
	my $infh = \*DOWNLOADFILEFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
	binmode $infh;
	my $blocksize = (stat $infh)[11] ? (stat $infh)[11] : 16384;
	while($read = sysread($infh, $buf, $blocksize))
	{
		unless(defined($read))
		{
			next if $! =~ /^Interrupted/;
			die "$0: download_file(): read error: $!\n";
		}

		my ($written,$offset) = (0,0);
		while($read)
		{
			$written = syswrite(STDOUT, $buf, $read, $offset);
			unless(defined($written))
			{
				die "$0: download_file(): write error: $!\n";
			}

			$read -= $written;
			$offset += $written;
		}
	}
	close $infh or die "$0: couldn't close file '$fullfile' after reading: $!\n";

	if($PREF{log_all_downloads} =~ /yes/i   ||   $PREF{send_download_notification_emails} =~ /yes/i)
	{
		my $userdir			= $PREF{userdir} || '(none)';
		my $username			= $PREF{logged_in_username} ? $PREF{logged_in_username} : '(none)';
		my $ua				= $ENV{HTTP_USER_AGENT};
		my $etime			= offsettime();
		my $date			= strftime("%Y%m%d-%H%M",localtime($etime));

		sql_untaint($file, $path, $size, $PREF{ip}, $PREF{host}, $userdir, $username, $ua, $date, $etime);
		die_unless_sqlsafe($file, $path, $size, $PREF{ip}, $PREF{host}, $userdir, $username, $ua, $date, $etime);

		if($PREF{log_all_downloads} =~ /yes/i)
		{
			enc_sql_insert("INSERT INTO `$PREF{download_log_table}`
						(`path`,`file`,`size`,`ip`,`host`,`userdir`,`username`,`useragent`,`date`,`etime`)
					VALUES('$path', '$file', '$size', '$PREF{ip}', '$PREF{host}', '$userdir', '$username', '$ua', '$date', '$etime')
			");
		}

		if($PREF{send_download_notification_emails} =~ /yes/i)
		{
			foreach my $pref (sort keys %PREF)
			{
				if($pref =~ /^download_notification_email_recipient_\d+$/)
				{
					my $to = '';
					if(is_valid_email_address($PREF{$pref}))
					{
						$to = $PREF{$pref};
					}
					elsif($PREF{$pref} eq '%%uploader_email_address%%')
					{
						$to = enc_sql_select("SELECT `$PREF{uploader_email_address_formfield_shortname}` FROM `$PREF{upload_log_table}` WHERE `filepath` = '$path' AND `filename` = '$file' ORDER BY `id` DESC LIMIT 1");
					}
					next unless is_valid_email_address($to);

					my $from = $PREF{download_notification_email_sender};
					my $subject = $PREF{download_notification_email_subject};
					my $message = $PREF{download_notification_email_template};

					my $href = get_download_link('emails', $path, $file);
					$href = $PREF{protoprefix} . $ENV{HTTP_HOST} . $href unless $href =~ m!^https?://!;

					for($subject, $message)
					{
						s!%%filename%%!$file!g;
						s!%%linktofile%%!$href!g;
						s!%%filepath%%!$path!g;
						s!%%filesize%%!format_filesize_nicely($size)!eg;
						s!%%ip%%!$PREF{ip}!g;
						s!%%host%%!$PREF{host}!g;
						s!%%ua%%!$ua!g;
						s!%%userdir%%!$userdir!g;
						s!%%username%%!$username!g;
						s!%%date%%!$date!g;
						s!%%date--(.+?)%%!strftime($1, localtime(offsettime()))!eg;
					}

					my $email_format = $PREF{download_notification_email_type} =~ m!html!i ? 'text/html' : undef;
					send_email($to, $from, $subject, $message, $email_format, $PREF{email_failure_action});
				}
			}
		}
	}

	if($PREF{update_timestamp_on_download} =~ /yes/i)
	{
		use ExtUtils::Command 'touch';
		local @ARGV = ();
		push @ARGV, $fullfile;
		touch; # modifies only items in @ARGV.
	}
}


sub get_uploaded_files_url_path
{
	my $arg = shift || '';
	my $strip_trailing_slash = $arg eq 'without_trailing_slash' ? 1 : 0;
	return '' if $PREF{hide_path_to_uploads_dir} =~ /yes/i;

	my $path = $PREF{uploaded_files_urlpath};
	$path =~ s!/+$!! if $strip_trailing_slash;
	return $path;
}


sub print_size_or_count_error
{
	my $error = shift;
	my $attempted_amount = shift;
	my $limit = shift;

	start_html_output('Error');

	my ($upload_size, $nice_limit) = ();
	if($error =~ /toobig|globalquotaexceeded|userquotaexceeded/)
	{
		$upload_size = format_filesize_nicely($attempted_amount);
		$nice_limit = format_filesize_nicely($limit);
	}

	if($error eq 'toobig')
	{
		$TEXT{upload_too_big_error} =~ s!%%upload_size%%!$upload_size!g;
		$TEXT{upload_too_big_error} =~ s!%%limit%%!$nice_limit!g;
		print $TEXT{upload_too_big_error};
	}
	elsif($error eq 'globalquotaexceeded')
	{
		print qq`<h1>Error:</h1><p>You tried to send $upload_size, which would have expanded the upload directory beyond its global quota of $nice_limit.</p>\n`;
	}
	elsif($error eq 'userquotaexceeded')
	{
		print qq`<h1>Error:</h1><p>You tried to send $upload_size, which would have expanded your upload directory beyond its quota of $nice_limit.</p>\n`;
	}
	elsif($error eq 'toomany')
	{
		$TEXT{upload_too_many_files_error} =~ s!%%upload_count%%!$attempted_amount!g;
		$TEXT{upload_too_many_files_error} =~ s!%%limit%%!$limit!g;
		print $TEXT{upload_too_many_files_error};
	}

	finish_html_output();
}


sub unzip_files
{
	my $query = new CGI();

	start_html_output('Unzipping...');
	print_http_headers();
	print "todo\n";
	finish_html_output();
}


sub print_notadmin_error_with_link_to_login_page()
{
	print qq`<p>You must <a href="$PREF{login_url}">login</a> as an administrator to use that facility.</p>\n`;
}


sub rotate_images($$)
{
	my ($degrees, $path) = @_;
	enc_urldecode($path);

	my ($query, %params) = ();
	if($qs =~ /(?:^|&)mode=single&name=(.+?)(?:&|$)/)
	{
		$params{$1} = 1;
		enc_urldecode($params{$1});
	}
	else
	{
		$query = new CGI(); # must happen if we were POSTed to, or there's a weird delay between client/server after the script finishes.
		%params = $query->Vars;
	}

	exit_with_error("Error: access denied.") unless user_is_allowed_to('rotate_images');

	my $fullpath = "$PREF{uploaded_files_realpath}/$path/";
	condense_slashes('leave_leading_UNC', $fullpath);

	foreach my $param(sort keys %params)
	{
		#print "$param: $params{$param}<br />\n";
		if(my ($filename) = ($param =~ /^file-(.+)/))
		{
			my $infile = my $outfile = "$fullpath$filename";
			my $thumb = "$fullpath$PREF{filelist_thumbnail_dir_name}/$filename";

			rotate_image($infile, $outfile, $degrees);
			make_thumbnail($outfile, $thumb);
		}
	}

	enc_redirect($ENV{HTTP_REFERER} ? $ENV{HTTP_REFERER} : "$PREF{protoprefix}$ENV{HTTP_HOST}$PREF{here_filelist_qsready}action=listfiles");
}


sub make_thumbnail($$)
{
	my ($image_file, $thumb) = @_;

	my ($output_dir) = ($thumb =~ m!(.*)[/\\]!);
	create_dir_if_DNE($output_dir,$PREF{writable_dir_perms}) if $output_dir;

	my $thumbsize = get_thumbnail_size_setting();

	my ($origw,$origh) = get_image_dims($image_file);
	my ($thumbw,$thumbh) = ($thumbsize =~ /^(\d*)x?(\d*)$/i);

	if($origw > $thumbw || $origh > $thumbh || !$origw || !$thumbw)
	{
		if(!$thumbw || !$thumbh)
		{
			# If only one dimension is specified, then treat it as the max
			# for the longest image side.  That means if it's a landscape
			# image then the specified dimension is the width; else if it's
			# a portrait image then the specified dimension is the height.
			#
			# Note that this isn't necessary when using ImageMagick, because
			# with IM you can just specify the thumbsize as NNNxNNN and it
			# will treat BOTH dimensions as max limits, rather than scaling
			# (and distorting) to exactly your NNNxNNN value.  That's why we
			# have separate thumbsize PREFs for IM and GD.
			#
			if(($origw > $origh) && !$thumbw)	{ $thumbw = $thumbh; $thumbh = ''; }
			elsif(($origw < $origh) && !$thumbh)	{ $thumbh = $thumbw; $thumbw = ''; }
		}
		#resize_image($image_file, $thumb, $thumbsize);
		resize_image___withtimeout($PREF{image_resizing_timeout}, $image_file, $thumb, $thumbsize);
	}
	else
	{
		copy($image_file, $thumb) or die "$0: couldn't copy image file '$image_file' to thumbnail file '$thumb': $!\n";
	}
	chmod $PREF{writable_file_perms}, $thumb;
}


sub make_video_thumbnail($$)
{
	my ($vidfile,$vidthumb) = @_;

	# ffmpeg requires that the output thumbnail filename contain a literal
	# "%d" in the command line, which ffmpeg will then replace with the
	# sequence number of the frame pulled from the video file.  Since our
	# ffmpeg command will only grab a single frame, this sequence number
	# will always be 1, but nonetheless the command requires "%d" to be
	# present.
	#
	my $vidthumb_for_ffmpeg_command	= my $vidthumb_with_sequence_number = $vidthumb;
	$vidthumb_with_sequence_number	=~ s!(\.\w+)$!-1$1!;
	$vidthumb_for_ffmpeg_command	=~ s!(\.\w+)$!-%d$1!;

	my $cmd = $PREF{video_thumb_command};
	$cmd =~ s!%%input_video_filename%%!$vidfile!g;
	$cmd =~ s!%%output_image_filename%%!$vidthumb_for_ffmpeg_command!g;
	my ($success,$msg) = enc_sys_call($cmd);

	if(!$success)
	{
		my $error = qq`error executing video-thumbnail command: $msg [[ command was: $cmd ]]`;
		$PREF{ignore_video_thumbnailing_errors} =~ /yes/i ? enc_warn $error : die_nice $error;
	}
	else
	{
		if(! -e $vidthumb_with_sequence_number)
		{
			my $error = qq`error: output file does not exist after executing video-thumbnail command: "$vidthumb_with_sequence_number" [[ command was: $cmd ]]`;
			$PREF{ignore_video_thumbnailing_errors} =~ /yes/i ? enc_warn $error : die_nice $error;
		}
		else
		{
			# Rename the video thumbnail to remove the ffmpeg sequence number:
			if(!rename($vidthumb_with_sequence_number, $vidthumb))
			{
				my $error = qq`error: couldn't rename video thumbnail ("$vidthumb_with_sequence_number") to remove its sequence number: $!\n`;
				$PREF{ignore_video_thumbnailing_errors} =~ /yes/i ? enc_warn $error : die_nice $error;
			}

			# Resize the video thumbnail to our standard thumbnail size:
			if(image_thumbnails_possible() && -e $vidthumb)
			{
				my $thumbsize = get_thumbnail_size_setting();
				#resize_image($vidthumb, $vidthumb, $thumbsize);
				resize_image___withtimeout($PREF{video_thumbnail_creation_timeout}, $vidthumb, $vidthumb, $thumbsize);
			}
		}
	}
}


sub get_thumbnail_size_setting
{
	my $thumbsize = ($PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_resizing} =~ /yes/i) || $PREF{try_to_use_convert_for_resizing} =~ /yes/i ? $PREF{filelist_thumbnail_size__imagemagick} : gd_is_available() ? $PREF{filelist_thumbnail_size__gd} : '';
	return $thumbsize;
}


sub rotate_image($$$)
{
	my ($infile,$outfile,$degrees) = @_;
	return unless $infile =~ /$PREF{rotatable_image_extensions}/i;

	if($PREF{jpegtran_available} =~ /yes/i   &&   $PREF{try_to_use_jpegtran_for_rotation} =~ /yes/i   &&   $infile =~ /\.(jpg|jpe|jpeg)$/i)
	{
		printd qq`rotate_image(): using JT\n`;
		my $cmd = qq`$PREF{jpegtran_command} -rotate $degrees -copy all -outfile $outfile $infile`;
		my ($success,$msg) = enc_sys_call($cmd);
		unless($success) { die_nice(qq`$PREF{internal_appname}: rotate_image() failed: $msg`); }
	}
	elsif($PREF{convert_available} =~ /yes/i   &&   $PREF{try_to_use_convert_for_rotation} =~ /yes/i)
	{
		printd qq`rotate_image(): using convert\n`;
		my $cmd = qq`$PREF{convert_command} -filter lanczos -quality 95 -rotate $degrees "$infile" "$outfile"`;
		my ($success,$msg) = enc_sys_call($cmd);
		unless($success) { die_nice(qq`rotation failed: $msg`); }
	}
	elsif($PREF{imagemagick_available}   &&   $PREF{try_to_use_imagemagick_for_rotation} =~ /yes/i)
	{
		printd qq`rotate_image(): using IM\n`;

		my $image = new Image::Magick;
		my $retval = ();

		$retval = $image->Read($infile);
		if($retval)	{ printd "$0: error: rotate_image(): \$image->Read()   returned $retval.\n"; return;	}

		$retval = $image->Rotate(degrees=>$degrees);
		if($retval)	{ printd "$0: error: rotate_image(): \$image->Rotate() returned $retval.\n"; return;	}

		$image->Set(quality=>100);
		$image->Write($outfile);
	}
	elsif(gd_is_available()   &&   $PREF{try_to_use_gd_for_rotation} =~ /yes/i)
	{
		printd qq`rotate_image(): using GD\n`;

		my $inputimage = GD::Image->newTrueColor($infile);
		if(!$inputimage)	{ enc_warn "$0: error: rotate_image(): GD::Image->new($infile) returned null...\n"; return;	}

		my $outputimage = ();
		   if($degrees == 90)	{ $outputimage = $inputimage->copyRotate90(); }
		elsif($degrees == 180)	{ $outputimage = $inputimage->copyRotate180(); }
		elsif($degrees == 270)	{ $outputimage = $inputimage->copyRotate270(); }

		my ($extension) = ($outfile =~ /\.(\w+)$/);
		my $tempfilename = enc_hash($outfile . time) . '.fctemp.' . $extension;
		my $tempfile = "$PREF{datadir}/$tempfilename";

		open(ROTIMG, ">$tempfile") or die "$0: couldn't create file '$tempfile': $!\n";
		my $fh = \*ROTIMG; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		binmode $fh;
		   if($outfile =~ /\.jpe?g$/i)	{ print $fh $outputimage->jpeg(100);	}
		elsif($outfile =~ /\.png$/i)	{ print $fh $outputimage->png(1);	}
		elsif($outfile =~ /\.gif$/i)	{ print $fh $outputimage->gif();	}
		else				{ die "$0: rotate_image(): image format not supported by GD.\n"; }
		close $fh or die "$0: couldn't close file '$tempfile' after creating it: $!\n";

		if(!rename($tempfile, $outfile))
		{
			unlink $tempfile;
			die_nice(qq`$PREF{internal_appname}: rotate_image($infile, $outfile, $degrees): couldn't rename tempfile ('$tempfile') to final file ('$outfile'): $!\n`);
		}
	}
	else
	{
		die_nice "$PREF{internal_appname}: no image-rotating library available...\n";
	}
}


sub is_image
{
	return $_[0] =~ /($PREF{filelist_thumbnail_image_extensions}|$PREF{resizable_image_extensions}|$PREF{rotatable_image_extensions}|$PREF{image_extensions_to_try_to_get_dimensions_from})/i;
}


sub is_video
{
	return $_[0] =~ /($PREF{video_thumbnail_image_extensions})/i;
}


# Pass in the filename of a video file, get back
# the same filename but with an image extension.
#
sub get_video_thumb_filename($)
{
	my $filename = shift;
	$filename =~ s/\.\w+$/.jpg/ if is_video($filename);
	return $filename;
}


sub force_update_of_thumbs_cache
{
	if(user_is_allowed_to('force_update_of_thumbs_cache'))
	{
		if($qs =~ /makethumbs=1/)
		{
			return 1;
		}
	}
}


sub find_first_image_in_dir
{
	my $dir = shift;
	my $sizelimit = shift;
	return unless -d $dir;
	
	my @all_dirs = ($dir);
	my @all_subdirs = get_all_subdirs($dir);
	for(@all_subdirs)
	{
		push @all_dirs, $dir . '/' . $_;
	}
	foreach my $subdir (@all_dirs)
	{
		# don't use images from our own thumbnail folders.
		next if $subdir =~ m!(^|/|\\)$PREF{filelist_thumbnail_dir_name}(/|\\|$)!;
		next unless -r $subdir; # if we encounter an unreadable subdir, don't die, just skip it.

		opendir(my $dirh, $subdir) or die "$0: 23 couldn't open directory $subdir: $!\n";
		my @files = sort { lc($a) cmp lc($b) } grep {  ! -d "$subdir/$_" } readdir($dirh);
		closedir $dirh or die "$0: couldn't close directory $subdir: $!\n";
		for(@files)
		{
			if(is_image($_))
			{
				return "$subdir/$_" if (!$sizelimit   ||   -s "$subdir/$_" < $sizelimit);
			}
		}
	}
}


sub find_first_video_in_dir
{
	my $dir = shift;
	return unless -d $dir;
	
	my @all_dirs = ($dir);
	my @all_subdirs = get_all_subdirs($dir);
	for(@all_subdirs)
	{
		push @all_dirs, $dir . '/' . $_;
	}
	foreach my $subdir (@all_dirs)
	{
		next unless -r $subdir; # if we encounter an unreadable subdir, don't die, just skip it.
		opendir(my $dirh, $subdir) or die "$0: 24 couldn't open directory $subdir: $!\n";
		my @files = sort { lc($a) cmp lc($b) } grep {  ! -d "$subdir/$_" } readdir($dirh);
		closedir $dirh or die "$0: couldn't close directory $subdir: $!\n";
		for(@files)
		{
			if(is_video($_))
			{
				return "$subdir/$_";
			}
		}
	}
}


sub image_thumbnails_possible()		{ return ($PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_resizing} =~ /yes/i   ||   gd_is_available() && $PREF{try_to_use_gd_for_resizing} =~ /yes/i   ||   $PREF{convert_available} =~ /yes/i && $PREF{try_to_use_convert_for_resizing} =~ /yes/i); }
#sub image_thumbnail_prefs_enabled()	{ return ($PREF{enable_file_thumbnails_in_filelist} =~ /yes/i || $PREF{enable_folder_thumbnails_in_filelist} =~ /yes/i); }

sub image_rotation_possible		{ my $file = shift; return ( $PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_rotation} =~ /yes/i   ||   gd_is_available() && $PREF{try_to_use_gd_for_rotation} =~ /yes/i   ||   $PREF{convert_available} =~ /yes/i && $PREF{try_to_use_convert_for_rotation} =~ /yes/i   ||   $PREF{jpegtran_available} =~ /yes/i && $PREF{try_to_use_jpegtran_for_rotation} =~ /yes/i && (!$file || $file =~ /\.jp(e|g|eg)$/i) ); }
#sub image_rotation_prefs_enabled()	{ return ($PREF{enable_rotate90_action} || $PREF{enable_rotate180_action} || $PREF{enable_rotate270_action}); }

sub image_humantest_possible()		{ return ($PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_humantest} =~ /yes/i   ||   gd_is_available() && $PREF{try_to_use_gd_for_humantest} =~ /yes/i   ||   $PREF{convert_available} =~ /yes/i && $PREF{try_to_use_convert_for_humantest} =~ /yes/i); }
#sub image_humantest_prefs_enabled()	{ return ($PREF{enable_human_test} =~ /yes/i); }

sub video_thumbnails_possible()		{ return ($PREF{video_thumb_command}); } # TODO: find an effective way to actually test the command.


sub file_thumbnails_enabled()
{
	return 0 if $qs =~ /thumbs=off/;
	my $enabled = 0;
	if($PREF{enable_file_thumbnails_in_filelist} =~ /yes/i)
	{
		if($PREF{image_thumbnails_on_by_default} =~ /yes/i)
		{
			$enabled = 1 unless ($PREF{visitors_can_toggle_thumbnails_on_and_off} =~ /yes/i   &&   $PREF{file_thumbnail_cookie_disabled});
		}
		else
		{
			$enabled = 1 if ($PREF{visitors_can_toggle_thumbnails_on_and_off} =~ /yes/i   &&   $PREF{file_thumbnail_cookie_enabled});
		}
	}
	return $enabled;
}


sub folder_thumbnails_enabled()
{
	return 0 if $qs =~ /thumbs=off/;
	my $enabled = 0;
	if($PREF{enable_folder_thumbnails_in_filelist} =~ /yes/i)
	{
		if($PREF{folder_thumbnails_on_by_default} =~ /yes/i)
		{
			$enabled = 1 unless ($PREF{visitors_can_toggle_thumbnails_on_and_off} =~ /yes/i   &&   $PREF{folder_thumbnail_cookie_disabled});
		}
		else
		{
			$enabled = 1 if ($PREF{visitors_can_toggle_thumbnails_on_and_off} =~ /yes/i   &&   $PREF{folder_thumbnail_cookie_enabled});
		}
	}
	return $enabled;
}


sub video_thumbnails_enabled()
{
	return 0 if $qs =~ /thumbs=off/;
	my $enabled = 0;
	if($PREF{enable_video_thumbnails_in_filelist} =~ /yes/i)
	{
		if($PREF{video_thumbnails_on_by_default} =~ /yes/i)
		{
			unless($PREF{visitors_can_toggle_thumbnails_on_and_off} =~ /yes/i   &&   $PREF{video_thumbnail_cookie_disabled})
			{
				$enabled = 1;
			}
		}
		else
		{
			if($PREF{visitors_can_toggle_thumbnails_on_and_off} =~ /yes/i   &&   $PREF{video_thumbnail_cookie_enabled})
			{
				$enabled = 1;
			}
		}
	}
	return $enabled;
}


sub custom_folder_perms_enabled
{
	return ($PREF{enable_old_custom_folder_permissions} =~ /yes/i   ||   $PREF{enable_new_custom_folder_permissions} =~ /yes/i);
}


sub show_permissions($)
{
	$PREF{enable_old_custom_folder_permissions} =~ /yes/i ? show_permissions___oldsystem(@_) : show_permissions___newsystem(@_);
}


sub show_permissions___oldsystem($)
{
	my $item = shift;
	slashify($item);
	enc_urldecode($item);

	exit_with_error("Access denied: insufficient permissions to access this page.") unless logged_in_user_has_permission_to_view_perms($item);
	exit_with_error("This feature is not enabled.") unless custom_folder_perms_enabled();

	my $realpath_to_item = $PREF{uploaded_files_realpath} . '/' . $item;   # slashify($realpath_to_item);   # slashifying this causes the -d test to always fail on Windows servers; and is it really necessary in any case?
	exit_with_error("That directory does not exist.") unless -d $realpath_to_item;


	start_html_output();
	print qq`<h3>Permissions for <a href="$PREF{here_filelist_qsready}action=listfiles&amp;path=$item">$item</a></h3>\n`;
	my $parent = $item;
	remove_deepest_level($parent);

	my $parentlink = qq`<a href="$PREF{here_filelist_qsready}action=listfiles&amp;path=$parent">parent folder</a>`;
	my $parentpermslink = qq`<a href="$PREF{here_qsready}action=showperms&amp;item=$parent">parent permissions</a>`;
	my $allpermslink = qq`<a href="$PREF{here_qsready}action=showallperms">all permissions</a>`;

	my $showparentlink = folder_is_allowed_to_be_displayed($parent) && $parent ne $item;
	my $showparentpermslink = logged_in_user_has_permission_to_view_perms($parent) && $parent ne $item;
	my $showallpermslink = $PREF{admin_is_logged_in};

	my @toplinks = ();
	push (@toplinks, $parentlink) if $showparentlink;
	push (@toplinks, $parentpermslink) if $showparentpermslink;
	push (@toplinks, $allpermslink) if $showallpermslink;

	if(@toplinks)
	{
		print qq`<p>( `;
		print join " &#8211; ", @toplinks;
		print qq` )</p>`;
	}



	my %users_with_perms = ();
	if(userbase_available())
	{
		foreach my $level ('rw', 'ro')
		{
			if(my $users = get_users_with_direct_access_to_item($level, $item))
			{
				foreach my $uid (split(/,/, $users))
				{
					my $username = get_user_name($uid);
					$users_with_perms{$username}{id} = $uid;
					$users_with_perms{$username}{$level}{direct} = 1;
				}
			}
			if(my $users = get_users_with_inherited_access_to_item($level, $item))
			{
				foreach my $uid (split(/,/, $users))
				{
					my $username = get_user_name($uid);
					$users_with_perms{$username}{id} = $uid;
					$users_with_perms{$username}{$level}{inherited} = 1;
				}
			}
		}
	}

	my %groups_with_perms = ();
	foreach my $level ('rw', 'ro')
	{
		if(my $groups = get_groups_with_direct_access_to_item($level, $item))
		{
			foreach my $gid (split(/,/, $groups))
			{
				my $groupsname = get_group_name($gid);
				$groups_with_perms{$groupsname}{id} = $gid;
				$groups_with_perms{$groupsname}{$level}{direct} = 1;
			}
		}
		if(my $groups = get_groups_with_inherited_access_to_item($level, $item))
		{
			foreach my $gid (split(/,/, $groups))
			{
				my $groupsname = get_group_name($gid);
				$groups_with_perms{$groupsname}{id} = $gid;
				$groups_with_perms{$groupsname}{$level}{inherited} = 1;
			}
		}
	}

	my $letter = $qs =~ /(?:^|&)which=([a-z])(?:&|$)/i ? $1 : $qs =~ /(?:^|&)which=all(?:&|$)/i ? 'all' : 'all';

	my $editable = logged_in_user_has_permission_to_change_perms($item);

	print qq`<form method="post" action="$ENV{SCRIPT_NAME}?action=changeperms" id="perms" />\n`;

	print qq`<div id="itemperms" class="enc_tbl"><table>\n`;
	print qq`<tr><th>Name</th><th>Read-Only<br />Access</th><th>Read/Write<br />Access</th></tr>\n`;
	print qq`\n\n<tr class="heading"><td colspan="3">` . (userbase_available() ? 'All users/groups' : 'Groups') . qq` with permissions set on this folder:</td></tr>`;
	my $some_perms_set = 0;
	my $i = 0;
	foreach my $group (sort { lc($a) cmp lc($b) } keys %groups_with_perms)
	{
		next if $group =~ /^$PREF{admin_group_name}$/i; # admins always have full access.
		if(userbase_available())
		{
			next unless display_group_on_perms_page_for_loggedin_user($group,$item);
		}
		else
		{
			next unless $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i;
		}
		my $rocheckbox = qq`<input type="checkbox" name="group-$groups_with_perms{$group}{id}-ro" ` . ($groups_with_perms{$group}{ro}{direct} ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;
		my $rwcheckbox = qq`<input type="checkbox" name="group-$groups_with_perms{$group}{id}-rw" ` . ($groups_with_perms{$group}{rw}{direct} ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;

		if($groups_with_perms{$group}{ro}{inherited} && $groups_with_perms{$group}{rw}{inherited})
		{
			if(find_closest_inherited_permissions_for_id('group', $groups_with_perms{$group}{id}, $item) =~ /^ro/)	{ $groups_with_perms{$group}{rw}{inherited} = 0; }
			else													{ $groups_with_perms{$group}{ro}{inherited} = 0; }
		}

		my $inh_ro = $groups_with_perms{$group}{ro}{inherited} ? '(inh)' : undef;
		my $inh_rw = $groups_with_perms{$group}{rw}{inherited} ? '(inh)' : undef;

		my $group_display = $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i ? "<strong>$group</strong>" : $group;

		print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">Group $group_display</td><td class="ro">$rocheckbox RO $inh_ro</td><td class="rw">$rwcheckbox RW $inh_rw</td></tr>`;
		$some_perms_set = 1;
	}
	if(userbase_available()   &&   display_user_on_perms_page_for_loggedin_user($item))
	{
		foreach my $user (sort { lc($a) cmp lc($b) } keys %users_with_perms)
		{
			next if is_admin($users_with_perms{$user}{id}); # admins always have full access.
			my $rocheckbox = qq`<input type="checkbox" name="user-$users_with_perms{$user}{id}-ro" ` . ($users_with_perms{$user}{ro}{direct} ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;
			my $rwcheckbox = qq`<input type="checkbox" name="user-$users_with_perms{$user}{id}-rw" ` . ($users_with_perms{$user}{rw}{direct} ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;

			if($users_with_perms{$user}{ro}{inherited} && $users_with_perms{$user}{rw}{inherited})
			{
				if(find_closest_inherited_permissions_for_id('user', $users_with_perms{$user}{id}, $item) =~ /^ro/)	{ $users_with_perms{$user}{rw}{inherited} = 0; }
				else													{ $users_with_perms{$user}{ro}{inherited} = 0; }
			}

			my $inh_ro = $users_with_perms{$user}{ro}{inherited} ? '(inh)' : undef;
			my $inh_rw = $users_with_perms{$user}{rw}{inherited} ? '(inh)' : undef;

			print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">User $user</td><td class="ro">$rocheckbox RO $inh_ro</td><td class="rw">$rwcheckbox RW $inh_rw</td></tr>`;
			$some_perms_set = 1;
		}
	}

	print qq`\n\n<tr class="` . oddeven($i) . qq`"><td colspan="3">(none)</td></tr>` unless $some_perms_set;


	if($editable)
	{
		print qq`\n\n<tr class="heading"><td colspan="3">` . (userbase_available() ? 'Users/Groups' : 'Groups') . qq` with no permissions set on this folder` . (userbase_available() ? qq` (filter: '$letter')` : undef) . qq`:</td></tr>`;
		my $some_rows_displayed = 0;

		my $restriction = ($letter eq 'all' || !userbase_available()) ? undef : " WHERE LOWER(`group`) LIKE LOWER('$letter%') ";

		my %allgroups = ();
		if(userbase_available())
		{
			my ($gid,$group) = ();
			my $sth = $PREF{dbh}->prepare("SELECT `id`,`group` FROM `$PREF{group_table}`${restriction}ORDER BY `group`");
			$sth->execute() or die_nice("$0: show_permissions() failed: $DBI::errstr\n");
			$sth->bind_columns(\$gid,\$group);
			while($sth->fetchrow_arrayref)
			{
				$allgroups{$group} = $gid;
			}
		}
		else
		{
			$allgroups{$PREF{public_group_name}}	= -1;
			$allgroups{$PREF{member_group_name}}	= -2;
			# don't process the admin group here since admins always have full access.
		}

		foreach my $group (sort keys %allgroups)
		{
			my $gid = $allgroups{$group};

			unless($groups_with_perms{$group})
			{
				next if $group =~ /^$PREF{admin_group_name}$/i; # admins always have full access.
				if(userbase_available())
				{
					next unless display_group_on_perms_page_for_loggedin_user($group,$item);
				}
				else
				{
					next unless $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i;
				}
				my $rocheckbox = qq`<input type="checkbox" name="group-$gid-ro" />`;
				my $rwcheckbox = qq`<input type="checkbox" name="group-$gid-rw" />`;
				my $group_display = $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i ? "<strong>$group</strong>" : $group;
				print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">Group $group_display</td><td class="ro">$rocheckbox RO</td><td class="rw">$rwcheckbox RW</td></tr>`;
				$some_rows_displayed = 1;
			}
		}

		if(userbase_available()   &&   display_user_on_perms_page_for_loggedin_user($item))
		{
			$restriction = $letter eq 'all' ? undef : " WHERE LOWER(`username`) LIKE LOWER('$letter%') ";

			my ($uid,$user) = ();
			my $sth = $PREF{dbh}->prepare("SELECT `id`,`username` FROM `$PREF{user_table}`${restriction}ORDER BY `username`");
			$sth->execute() or die_nice("$0: show_permissions() failed: $DBI::errstr\n");
			$sth->bind_columns(\$uid,\$user);
			while($sth->fetchrow_arrayref)
			{
				unless($users_with_perms{$user})
				{
					next if is_admin($uid); # admins always have full access.
					my $rocheckbox = qq`<input type="checkbox" name="user-$uid-ro" />`;
					my $rwcheckbox = qq`<input type="checkbox" name="user-$uid-rw" />`;
					print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">User $user</td><td class="ro">$rocheckbox RO</td><td class="rw">$rwcheckbox RW</td></tr>`;
					$some_rows_displayed = 1;
				}
			}
		}

		print qq`\n\n<tr class="` . oddeven($i) . qq`"><td colspan="3">(none)</td></tr>` unless $some_rows_displayed;

		print qq`\n\n<tr class="` . oddeven($i) . qq`"><td colspan="3"><input type="hidden" name="item" value="$item" /><input type="submit" value="Apply Changes" class="default button submit" /></td></tr>`;

	}


	print qq`\n</table></div>\n</form>\n`;


	if($editable && userbase_available())
	{
		print qq`<p class="itemperms-letters">\nFilter users/groups with no permissions:<br /><a href="$PREF{here_qsready}action=showperms&amp;item=$item&amp;which=all"` . ('all' eq lc($letter) ? ' class="current"' : undef) . qq`>All</a>`;
		foreach my $char ('A'..'Z')
		{
			print qq`<a href="$PREF{here_qsready}action=showperms&amp;item=$item&amp;which=$char"` . ($char eq uc($letter) ? ' class="current"' : undef) . qq`>$char</a>`;
		}
		print qq`\n</p>`;
	}

	my $user_vs_group = $PREF{user_perms_override_group_perms_for_same_folder} =~ /yes/i ? 'User permissions override group permissions' : 'Group permissions override user permissions';
	print qq`\n<p class="footnote">Notes: (inh) indicates a permission inherited from a parent folder.&nbsp; Permissions set directly on this folder override any inherited permissions.&nbsp; `;
	print qq`$user_vs_group when both apply to the same folder.&nbsp; ` if userbase_available();
	print qq`If no permissions have been set (direct or inherited) then the default access level is '$PREF{default_folder_rights}'.</p>`;


	finish_html_output();
}


sub show_permissions___newsystem($)
{
	my $item = shift;
	slashify($item);
	enc_urldecode($item);

	exit_with_error("Access denied: insufficient permissions to access this page.") unless logged_in_user_has_permission_to_view_perms($item);
	exit_with_error("This feature is not enabled.") unless custom_folder_perms_enabled();

	my $realpath_to_item = $PREF{uploaded_files_realpath} . '/' . $item;   # slashify($realpath_to_item);   # slashifying this causes the -d test to always fail on Windows servers; and is it really necessary in any case?
	exit_with_error("That directory does not exist.") unless -d $realpath_to_item;


	start_html_output();
	print qq`<h3>Permissions for <a href="$PREF{here_filelist_qsready}action=listfiles&amp;path=$item">$item</a></h3>\n`;
	my $parent = $item;
	remove_deepest_level($parent);

	my $parentlink = qq`<a href="$PREF{here_filelist_qsready}action=listfiles&amp;path=$parent">parent folder</a>`;
	my $parentpermslink = qq`<a href="$PREF{here_qsready}action=showperms&amp;item=$parent">parent permissions</a>`;
	my $allpermslink = qq`<a href="$PREF{here_qsready}action=showallperms">all permissions</a>`;

	my $showparentlink = folder_is_allowed_to_be_displayed($parent) && $parent ne $item;
	my $showparentpermslink = logged_in_user_has_permission_to_view_perms($parent) && $parent ne $item;
	my $showallpermslink = $PREF{admin_is_logged_in};

	my @toplinks = ();
	push (@toplinks, $parentlink) if $showparentlink;
	push (@toplinks, $parentpermslink) if $showparentpermslink;
	push (@toplinks, $allpermslink) if $showallpermslink;
	if(@toplinks) { print qq`<p>( ` . (join " &#8211; ", @toplinks) . qq` )</p>`; }



	my %users_with_perms = ();
	if(userbase_available())
	{
		foreach my $level ('write', 'read', 'denied')
		{
			if(my $users = get_users_with_direct_access_to_item($level, $item))
			{
				foreach my $uid (split(/,/, $users))
				{
					my $username = get_user_name($uid);
					$users_with_perms{$username}{id} = $uid;
					$users_with_perms{$username}{$level}{direct} = 1;
				}
			}
			if(my $users = get_users_with_inherited_access_to_item($level, $item))
			{
				foreach my $uid (split(/,/, $users))
				{
					my $username = get_user_name($uid);
					$users_with_perms{$username}{id} = $uid;
					$users_with_perms{$username}{$level}{inherited} = 1;
				}
			}
		}
	}

	my %groups_with_perms = ();
	foreach my $level ('write', 'read', 'denied')
	{
		if(my $groups = get_groups_with_direct_access_to_item($level, $item))
		{
			foreach my $gid (split(/,/, $groups))
			{
				my $groupsname = get_group_name($gid);
				$groups_with_perms{$groupsname}{id} = $gid;
				$groups_with_perms{$groupsname}{$level}{direct} = 1;
			}
		}
		if(my $groups = get_groups_with_inherited_access_to_item($level, $item))
		{
			foreach my $gid (split(/,/, $groups))
			{
				my $groupsname = get_group_name($gid);
				$groups_with_perms{$groupsname}{id} = $gid;
				$groups_with_perms{$groupsname}{$level}{inherited} = 1;
			}
		}
	}

	my $letter = $qs =~ /(?:^|&)which=([a-z])(?:&|$)/i ? $1 : $qs =~ /(?:^|&)which=all(?:&|$)/i ? 'all' : 'all';

	my $editable = logged_in_user_has_permission_to_change_perms($item);

	print qq`<form method="post" action="$ENV{SCRIPT_NAME}?action=changeperms" id="perms" />\n`;

	print qq`<div id="itemperms" class="enc_tbl"><table>\n`;
	print qq`<tr><th>Name</th><th>Read Access</th><th>Write Access</th><th>Deny Access</th></tr>\n`;
	print qq`\n\n<tr class="heading"><td colspan="4">` . (userbase_available() ? 'All users/groups' : 'Groups') . qq` with permissions set on this folder:</td></tr>`;
	my $some_perms_set = 0;
	my $i = 0;
	foreach my $group (sort { lc($a) cmp lc($b) } keys %groups_with_perms)
	{
		next if $group =~ /^$PREF{admin_group_name}$/i; # admins always have full access.
		if(userbase_available())
		{
			next unless display_group_on_perms_page_for_loggedin_user($group,$item);
		}
		else
		{
			next unless $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i;
		}
		my $readcheckbox   = qq`<input type="checkbox" name="group-$groups_with_perms{$group}{id}-read"   ` . ($groups_with_perms{$group}{read}{direct}   ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;
		my $writecheckbox  = qq`<input type="checkbox" name="group-$groups_with_perms{$group}{id}-write"  ` . ($groups_with_perms{$group}{write}{direct}  ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;
		my $deniedcheckbox = qq`<input type="checkbox" name="group-$groups_with_perms{$group}{id}-denied" ` . ($groups_with_perms{$group}{denied}{direct} ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;

		# Since inherited perms may be inherited from different levels within the parent folder
		# path, and some of those perms may contradict eachother, we need to check the closest
		# one, and then disable any others if they contradict the closest one.
		#	
		my $closest_inherited_perms = find_closest_inherited_permissions_for_id('group', $groups_with_perms{$group}{id}, $item);
		if($closest_inherited_perms =~ /d/)
		{
			$groups_with_perms{$group}{read}{inherited} = 0;
			$groups_with_perms{$group}{write}{inherited} = 0;
		}
		elsif($closest_inherited_perms =~ /[rw]/)
		{
			$groups_with_perms{$group}{denied}{inherited} = 0;
		}

		my $inh_read =   $groups_with_perms{$group}{read}{inherited}   ? '(inh)' : undef;
		my $inh_write =  $groups_with_perms{$group}{write}{inherited}  ? '(inh)' : undef;
		my $inh_denied = $groups_with_perms{$group}{denied}{inherited} ? '(inh)' : undef;

		my $group_display = $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i ? "<strong>$group</strong>" : $group;

		print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">Group $group_display</td>`
			. qq`<td class="read">$readcheckbox read $inh_read</td>`
			. qq`<td class="write">$writecheckbox write $inh_write</td>`
			. qq`<td class="denied">$deniedcheckbox deny $inh_denied</td>`
			. qq`</tr>`;

		$some_perms_set = 1;
	}
	if(userbase_available()   &&   display_user_on_perms_page_for_loggedin_user($item))
	{
		foreach my $user (sort { lc($a) cmp lc($b) } keys %users_with_perms)
		{
			next if is_admin($users_with_perms{$user}{id}); # admins always have full access.
			my $readcheckbox =   qq`<input type="checkbox" name="user-$users_with_perms{$user}{id}-read"   ` . ($users_with_perms{$user}{read}{direct}   ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;
			my $writecheckbox =  qq`<input type="checkbox" name="user-$users_with_perms{$user}{id}-write"  ` . ($users_with_perms{$user}{write}{direct}  ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;
			my $deniedcheckbox = qq`<input type="checkbox" name="user-$users_with_perms{$user}{id}-denied" ` . ($users_with_perms{$user}{denied}{direct} ? 'checked="checked"' : undef) . ($editable ? undef : ' disabled="disabled"') . qq` />`;

			# Since inherited perms may be inherited from different levels within the parent folder
			# path, and some of those perms may contradict eachother, we need to check the closest
			# one, and then disable any others if they contradict the closest one.
			#	
			my $closest_inherited_perms = find_closest_inherited_permissions_for_id('user', $users_with_perms{$user}{id}, $item);
			if($closest_inherited_perms =~ /d/)
			{
				$users_with_perms{$user}{read}{inherited} = 0;
				$users_with_perms{$user}{write}{inherited} = 0;
			}
			elsif($closest_inherited_perms =~ /[rw]/)
			{
				$users_with_perms{$user}{denied}{inherited} = 0;
			}

			my $inh_read   = $users_with_perms{$user}{read}{inherited}   ? '(inh)' : undef;
			my $inh_write  = $users_with_perms{$user}{write}{inherited}  ? '(inh)' : undef;
			my $inh_denied = $users_with_perms{$user}{denied}{inherited} ? '(inh)' : undef;

			print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">User $user</td>`
				. qq`<td class="read">$readcheckbox read $inh_read</td>`
				. qq`<td class="write">$writecheckbox write $inh_write</td>`
				. qq`<td class="denied">$deniedcheckbox deny $inh_denied</td>`
				. qq`</tr>`;

			$some_perms_set = 1;
		}
	}

	print qq`\n\n<tr class="noperms ` . oddeven($i) . qq`"><td colspan="4">(none)</td></tr>` unless $some_perms_set;


	if($editable)
	{
		print qq`\n\n<tr class="heading"><td colspan="4">` . (userbase_available() ? 'Users/Groups' : 'Groups') . qq` with no permissions set on this folder` . (userbase_available() ? qq` (filter: '$letter')` : undef) . qq`:</td></tr>`;
		my $some_rows_displayed = 0;

		my $restriction = ($letter eq 'all' || !userbase_available()) ? undef : " WHERE LOWER(`group`) LIKE LOWER('$letter%') ";

		my %allgroups = ();
		if(userbase_available())
		{
			my ($gid,$group) = ();
			my $sth = $PREF{dbh}->prepare("SELECT `id`,`group` FROM `$PREF{group_table}`${restriction}ORDER BY `group`");
			$sth->execute() or die_nice("$0: show_permissions() failed: $DBI::errstr\n");
			$sth->bind_columns(\$gid,\$group);
			while($sth->fetchrow_arrayref)
			{
				$allgroups{$group} = $gid;
			}
		}
		else
		{
			$allgroups{$PREF{public_group_name}}	= -1;
			$allgroups{$PREF{member_group_name}}	= -2;
			# don't process the admin group here since admins always have full access.
		}

		foreach my $group (sort keys %allgroups)
		{
			my $gid = $allgroups{$group};

			unless($groups_with_perms{$group})
			{
				next if $group =~ /^$PREF{admin_group_name}$/i; # admins always have full access.
				if(userbase_available())
				{
					next unless display_group_on_perms_page_for_loggedin_user($group,$item);
				}
				else
				{
					next unless $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i;
				}
				my $readcheckbox   = qq`<input type="checkbox" name="group-$gid-read" />`;
				my $writecheckbox  = qq`<input type="checkbox" name="group-$gid-write" />`;
				my $deniedcheckbox = qq`<input type="checkbox" name="group-$gid-denied" />`;
				my $group_display = $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i ? "<strong>$group</strong>" : $group;
				print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">Group $group_display</td><td class="read">$readcheckbox read</td><td class="write">$writecheckbox write</td><td class="denied">$deniedcheckbox deny</td></tr>`;
				$some_rows_displayed = 1;
			}
		}

		if(userbase_available()   &&   display_user_on_perms_page_for_loggedin_user($item))
		{
			$restriction = $letter eq 'all' ? undef : " WHERE LOWER(`username`) LIKE LOWER('$letter%') ";

			my ($uid,$user) = ();
			my $sth = $PREF{dbh}->prepare("SELECT `id`,`username` FROM `$PREF{user_table}`${restriction}ORDER BY `username`");
			$sth->execute() or die_nice("$0: show_permissions() failed: $DBI::errstr\n");
			$sth->bind_columns(\$uid,\$user);
			while($sth->fetchrow_arrayref)
			{
				unless($users_with_perms{$user})
				{
					next if is_admin($uid); # admins always have full access.
					my $readcheckbox   = qq`<input type="checkbox" name="user-$uid-read" />`;
					my $writecheckbox  = qq`<input type="checkbox" name="user-$uid-write" />`;
					my $deniedcheckbox = qq`<input type="checkbox" name="user-$uid-denied" />`;
					print qq`\n<tr class="` . oddeven($i) . qq`"><td class="name">User $user</td><td class="read">$readcheckbox read</td><td class="write">$writecheckbox write</td><td class="denied">$deniedcheckbox deny</td></tr>`;
					$some_rows_displayed = 1;
				}
			}
		}

		print qq`\n\n<tr class="noperms ` . oddeven($i) . qq`"><td colspan="4">(none)</td></tr>` unless $some_rows_displayed;

		print qq`\n\n<tr class="button ` . oddeven($i) . qq`"><td colspan="4"><input type="hidden" name="item" value="$item" /><input type="submit" value="Apply Changes" class="default button submit" /></td></tr>`;

	}


	print qq`\n</table></div>\n</form>\n`;


	if($editable && userbase_available())
	{
		print qq`<p class="itemperms-letters">\nFilter users/groups with no permissions:<br /><a href="$PREF{here_qsready}action=showperms&amp;item=$item&amp;which=all"` . ('all' eq lc($letter) ? ' class="current"' : undef) . qq`>All</a>`;
		foreach my $char ('A'..'Z')
		{
			print qq`<a href="$PREF{here_qsready}action=showperms&amp;item=$item&amp;which=$char"` . ($char eq uc($letter) ? ' class="current"' : undef) . qq`>$char</a>`;
		}
		print qq`\n</p>`;
	}

	my $user_vs_group = $PREF{user_perms_override_group_perms_for_same_folder} =~ /yes/i ? 'User permissions override group permissions' : 'Group permissions override user permissions';
	print qq`\n<p class="footnote">Notes: (inh) indicates a permission inherited from a parent folder.&nbsp; Permissions set directly on this folder cause any inherited permissions (for that user/group) to be ignored.&nbsp; `;
	print qq`$user_vs_group when both apply to the same folder.&nbsp; ` if userbase_available();
	print qq`If no permissions have been set (direct or inherited) then the default access level is '$PREF{default_folder_rights}'.</p>`;

	finish_html_output();
}


sub change_permissions()
{
	$PREF{enable_old_custom_folder_permissions} =~ /yes/i ? change_permissions___oldsystem() : change_permissions___newsystem();
}


sub change_permissions___oldsystem()
{
	die_nice("You must POST to get here...\n") unless $ENV{REQUEST_METHOD} =~ /post/i;
	exit_with_error("This feature is not enabled.") unless custom_folder_perms_enabled();

	my $item = param('item');
	slashify($item);

	#exit_with_error("You must be an admin to do that.") unless $PREF{admin_is_logged_in};
	exit_with_error("Access denied: insufficient permissions to access this page.") unless logged_in_user_has_permission_to_change_perms($item);

	my $rogroups	= get_groups_with_direct_access_to_item('ro', $item);
	my $rwgroups	= get_groups_with_direct_access_to_item('rw', $item);
	my $rousers	= get_users_with_direct_access_to_item('ro', $item);
	my $rwusers	= get_users_with_direct_access_to_item('rw', $item);

	my $groups = get_groups_hash();
	foreach my $group (sort keys %$groups)
	{
		if(userbase_available())
		{
			next unless display_group_on_perms_page_for_loggedin_user($group,$item);
		}
		else
		{
			next unless $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i;
		}

		my $gid = $$groups{$group}{id};
		if($rogroups   &&   $rogroups =~ /(^|,)$gid(,|$)/   &&   param("group-$gid-ro") !~ /on/i)
		{
			remove_access_from_item('groups', $gid, $item, 'ro');
		}
		elsif($rogroups !~ /(^|,)$gid(,|$)/   &&   param("group-$gid-ro") =~ /on/i)
		{
			add_access_to_item('groups', $gid, $item, 'ro');
		}

		if($rwgroups   &&   $rwgroups =~ /(^|,)$gid(,|$)/   &&   param("group-$gid-rw") !~ /on/i)
		{
			remove_access_from_item('groups', $gid, $item, 'rw');
		}
		elsif($rwgroups !~ /(^|,)$gid(,|$)/   &&   param("group-$gid-rw") =~ /on/i)
		{
			add_access_to_item('groups', $gid, $item, 'rw');
		}
	}


	if(userbase_available()   &&   display_user_on_perms_page_for_loggedin_user($item))
	{
		my ($uid,$user) = ();
		my $sth = $PREF{dbh}->prepare("SELECT `id`,`username` FROM `$PREF{user_table}`");
		$sth->execute() or die_nice("$0: change_permissions() failed: $DBI::errstr\n");
		$sth->bind_columns(\$uid,\$user);
		while($sth->fetchrow_arrayref)
		{
			if($rousers   &&   $rousers =~ /(^|,)$uid(,|$)/   &&   param("user-$uid-ro") !~ /on/i)
			{
				remove_access_from_item('users', $uid, $item, 'ro');
			}
			elsif($rousers !~ /(^|,)$uid(,|$)/   &&   param("user-$uid-ro") =~ /on/i)
			{
				add_access_to_item('users', $uid, $item, 'ro');
			}

			if($rwusers   &&   $rwusers =~ /(^|,)$uid(,|$)/   &&   param("user-$uid-rw") !~ /on/i)
			{
				remove_access_from_item('users', $uid, $item, 'rw');
			}
			elsif($rwusers !~ /(^|,)$uid(,|$)/   &&   param("user-$uid-rw") =~ /on/i)
			{
				add_access_to_item('users', $uid, $item, 'rw');
			}
		}
	}

	enc_redirect($ENV{HTTP_REFERER});
}


sub change_permissions___newsystem()
{
	die_nice("You must POST to get here...\n") unless $ENV{REQUEST_METHOD} =~ /post/i;
	exit_with_error("This feature is not enabled.") unless custom_folder_perms_enabled();

	my $item = param('item');
	slashify($item);

	#exit_with_error("You must be an admin to do that.") unless $PREF{admin_is_logged_in};
	exit_with_error("Access denied: insufficient permissions to access this page.") unless logged_in_user_has_permission_to_change_perms($item);

	my $readgroups	= get_groups_with_direct_access_to_item('read', $item);
	my $writegroups	= get_groups_with_direct_access_to_item('write', $item);
	my $deniedgroups= get_groups_with_direct_access_to_item('denied', $item);

	my $readusers	= get_users_with_direct_access_to_item('read', $item);
	my $writeusers	= get_users_with_direct_access_to_item('write', $item);
	my $deniedusers	= get_users_with_direct_access_to_item('denied', $item);

	my $groups = get_groups_hash();
	foreach my $group (sort keys %$groups)
	{
		if(userbase_available())
		{
			next unless display_group_on_perms_page_for_loggedin_user($group,$item);
		}
		else
		{
			next unless $group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i;
		}

		my $gid = $$groups{$group}{id};
		if($readgroups   &&   $readgroups =~ /(^|,)$gid(,|$)/   &&   param("group-$gid-read") !~ /on/i)
		{
			remove_access_from_item('groups', $gid, $item, 'read');
		}
		elsif($readgroups !~ /(^|,)$gid(,|$)/   &&   param("group-$gid-read") =~ /on/i)
		{
			add_access_to_item('groups', $gid, $item, 'read');
		}

		if($writegroups   &&   $writegroups =~ /(^|,)$gid(,|$)/   &&   param("group-$gid-write") !~ /on/i)
		{
			remove_access_from_item('groups', $gid, $item, 'write');
		}
		elsif($writegroups !~ /(^|,)$gid(,|$)/   &&   param("group-$gid-write") =~ /on/i)
		{
			add_access_to_item('groups', $gid, $item, 'write');
		}

		if($deniedgroups   &&   $deniedgroups =~ /(^|,)$gid(,|$)/   &&   param("group-$gid-denied") !~ /on/i)
		{
			remove_access_from_item('groups', $gid, $item, 'denied');
		}
		elsif($deniedgroups !~ /(^|,)$gid(,|$)/   &&   param("group-$gid-denied") =~ /on/i)
		{
			add_access_to_item('groups', $gid, $item, 'denied');
		}
	}


	if(userbase_available()   &&   display_user_on_perms_page_for_loggedin_user($item))
	{
		my ($uid,$user) = ();
		my $sth = $PREF{dbh}->prepare("SELECT `id`,`username` FROM `$PREF{user_table}`");
		$sth->execute() or die_nice("$0: change_permissions() failed: $DBI::errstr\n");
		$sth->bind_columns(\$uid,\$user);
		while($sth->fetchrow_arrayref)
		{
			if($readusers   &&   $readusers =~ /(^|,)$uid(,|$)/   &&   param("user-$uid-read") !~ /on/i)
			{
				remove_access_from_item('users', $uid, $item, 'read');
			}
			elsif($readusers !~ /(^|,)$uid(,|$)/   &&   param("user-$uid-read") =~ /on/i)
			{
				add_access_to_item('users', $uid, $item, 'read');
			}

			if($writeusers   &&   $writeusers =~ /(^|,)$uid(,|$)/   &&   param("user-$uid-write") !~ /on/i)
			{
				remove_access_from_item('users', $uid, $item, 'write');
			}
			elsif($writeusers !~ /(^|,)$uid(,|$)/   &&   param("user-$uid-write") =~ /on/i)
			{
				add_access_to_item('users', $uid, $item, 'write');
			}

			if($deniedusers   &&   $deniedusers =~ /(^|,)$uid(,|$)/   &&   param("user-$uid-denied") !~ /on/i)
			{
				remove_access_from_item('users', $uid, $item, 'denied');
			}
			elsif($deniedusers !~ /(^|,)$uid(,|$)/   &&   param("user-$uid-denied") =~ /on/i)
			{
				add_access_to_item('users', $uid, $item, 'denied');
			}
		}
	}

	enc_redirect($ENV{HTTP_REFERER});
}


sub display_group_on_perms_page_for_loggedin_user($$)
{
	my $group = shift;
	my $item = shift;
	if($PREF{admin_is_logged_in})
	{
		return 1;
	}
	elsif($group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i)
	{
		return 1;
	}
	elsif($PREF{users_changing_userdir_perms_can_see_other_groups} =~ /yes/i)
	{
		if($PREF{users_can_change_perms_in_own_userdir} =~ /yes/i)
		{
			# TODO: should we remove userbase_available() from this check, so this works for serial-userdirs too?
			#
			return 1 if (userbase_available()   &&   $PREF{userdir}   &&   $item =~ m!^/$PREF{userdir_folder_name}/$PREF{userdir}(/|$)!);
		}
	}
	else
	{
		return 0;
	}
}


sub display_user_on_perms_page_for_loggedin_user($)
{
	my $item = shift;
	if($PREF{admin_is_logged_in})
	{
		return 1;
	}
	elsif($PREF{users_changing_userdir_perms_can_see_other_users} =~ /yes/i)
	{
		if($PREF{users_can_change_perms_in_own_userdir} =~ /yes/i)
		{
			# TODO: should we remove userbase_available() from this check, so this works for serial-userdirs too?
			#
			return 1 if (userbase_available()   &&   $PREF{userdir}   &&   $item =~ m!^/$PREF{userdir_folder_name}/$PREF{userdir}(/|$)!);
		}
	}
	else
	{
		return 0;
	}
}


sub remove_access_from_item($$$$)
{
	my ($type, $id, $item, $level) = @_;

	slashify($item);
	sql_untaint($item);
	check_id_for_sql_safeness($id);

	my $list = enc_sql_select("SELECT `${level}${type}` FROM `$PREF{perms_table}` WHERE `path` = '$item'");
	$list =~ s/(^|,)($id)(,|$)/$1$3/;
	decommaify($list);

	my $statement = "UPDATE `$PREF{perms_table}` SET `${level}${type}` = '$list' WHERE `path` = '$item'";
	my $sth = $PREF{dbh}->prepare($statement);
	$sth->execute() or die_nice("$0: remove_access_from_item('$type', '$id', '$item', '$level') failed: $DBI::errstr\n");
}



sub add_access_to_item($$$$)
{
	my ($type, $id, $item, $level) = @_;

	create_custperms_record_for_item_if_DNE($item);

	slashify($item);
	sql_untaint($item);
	check_id_for_sql_safeness($id);

	my $existinglist = enc_sql_select("SELECT `${level}${type}` FROM `$PREF{perms_table}` WHERE `path` = '$item'");
	my $newlist = $existinglist . ',' . $id;
	$newlist =~ s/^,+//;

	my $statement = "UPDATE `$PREF{perms_table}` SET `${level}${type}` = '$newlist' WHERE `path` = '$item'";
	my $sth = $PREF{dbh}->prepare($statement);
	$sth->execute() or die_nice("$0: add_access_to_item('$type', '$id', '$item', '$level') failed: $DBI::errstr\n");

	if($PREF{enable_old_custom_folder_permissions} =~ /yes/i)
	{
		# since RO and RW are mutually exclusive, we now must remove the other one.
		my $oldlevel = $level =~ /^ro$/i ? 'rw' : 'ro';
		remove_access_from_item($type, $id, $item, $oldlevel);
	}
	else
	{
		# R & W are not mutually exclusive under the new custperms system, but each of them is mutually exclusive with D.
		if($level eq 'read'   ||   $level eq 'write')
		{
			remove_access_from_item($type, $id, $item, 'denied');
		}
		elsif($level eq 'denied')
		{
			remove_access_from_item($type, $id, $item, 'read');
			remove_access_from_item($type, $id, $item, 'write');
		}
	}
}


sub create_custperms_record_for_item_if_DNE($)
{
	my $item = shift;
	slashify($item);
	sql_untaint($item);
	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{perms_table}` WHERE `path` = '$item'") < 1)
	{
		my $statement = "INSERT INTO `$PREF{perms_table}` (path) VALUES('$item')";
		my $sth = $PREF{dbh}->prepare($statement);
		$sth->execute() or die_nice("inserting '$item' failed: $DBI::errstr\n");
	}
}


sub get_perms_link($$)
{
	my $path_urlencoded = shift;
	my $dir_urlencoded = shift;
	my $item = $path_urlencoded . '/' . $dir_urlencoded;
	slashify($item);

	my $link = qq`<a href="$PREF{here_filelist_qsready}action=showperms&item=$item">perms</a>`;
	return logged_in_user_has_permission_to_view_perms($item) ? $link : undef;
}


sub folder_perms_allow_reading($)
{
	my $path = shift;
	my $logged_in_user_perms = get_effective_folder_permissions($PREF{logged_in_username}, $path);
	my $SGM_perms = '';
	if(($PREF{subgroup_owned_users_have_same_folder_perms_as_their_subgroup_manager} =~ /yes/i)   &&   (my $SGM_username = logged_in_user_is_part_of_a_subgroup()))
	{
		$SGM_perms = get_effective_folder_permissions($SGM_username, $path);
	}
	my $perms = $logged_in_user_perms . $SGM_perms;
	return $perms =~ /r/i;
}


sub folder_perms_allow_writing($)
{
	my $path = shift;
	my $logged_in_user_perms = get_effective_folder_permissions($PREF{logged_in_username}, $path);
	my $SGM_perms = '';
	if(($PREF{subgroup_owned_users_have_same_folder_perms_as_their_subgroup_manager} =~ /yes/i)   &&   (my $SGM_username = logged_in_user_is_part_of_a_subgroup()))
	{
		$SGM_perms = get_effective_folder_permissions($SGM_username, $path);
	}
	my $perms = $logged_in_user_perms . $SGM_perms;
	return $perms =~ /w/i;
}


sub folder_perms_allow_reading_and_writing($)
{
	# Use this sub instead of calling both of the individual reading() and writing()
	# subs to avoid making two calls to the get_effective_folder_permissions() sub.

	my $path = shift;
	my $logged_in_user_perms = get_effective_folder_permissions($PREF{logged_in_username}, $path);
	my $SGM_perms = '';
	if(($PREF{subgroup_owned_users_have_same_folder_perms_as_their_subgroup_manager} =~ /yes/i)   &&   (my $SGM_username = logged_in_user_is_part_of_a_subgroup()))
	{
		$SGM_perms = get_effective_folder_permissions($SGM_username, $path);
	}
	my $perms = $logged_in_user_perms . $SGM_perms;
	return $perms =~ /r/i && $perms =~ /w/i;
}


sub get_effective_folder_permissions($$)
{
	my $username = shift || '';
	my $item = shift || '';
	printd "get_effective_folder_permissions('$username', '$item')\n";

	my $userid = get_user_id($username);
	return 'rw' if is_admin($userid);
	slashify($item);
	printd "get_effective_folder_permissions: userid=$userid\n";

	# If custom folder permissions aren't enabled, then the effective folder permissions
	# are RW.  This function does not concern itself with groups_allowed_to_*; that is a
	# question of permitted actions in general, and is handled by user_is_allowed_to() in
	# the caller.
	#
	if($PREF{enable_old_custom_folder_permissions} =~ /no/i   &&   $PREF{enable_new_custom_folder_permissions} =~ /no/i)
	{
		#if($PREF{enable_userdirs} =~ /yes/i && !is_userdir_folder_that_this_user_can_access($item))
		#{
		#	return '';
		#}
		#else
		#{
		#	return $PREF{default_userdir_folder_rights};
		#}
		
		if($PREF{enable_userdirs} =~ /yes/i)
		{
			if(this_is_the_userdir_folder($item))
			{
				# Special subgroup manager check: let SGMs have read access the root of the userdir folder
				# (subject to later checks in the file-list sub to restrict him to only his own sub-users).
				#
				return logged_in_user_is_subgroup_manager() ? 'r' : '';
			}
			else
			{
				my $readable = is_userdir_folder_that_this_user_can_read($item);
				my $writable = is_userdir_folder_that_this_user_can_write($item);
				if($readable && $writable)	{ return 'rw';	}
				elsif($readable)		{ return 'r';	}
				elsif($writable)		{ return 'w';	}
				else				{ return '';	}
			}
		}
		else
		{
			# If custom_folder_perms and userdirs are both disabled, then at
			# the folder level, the effective permissions are always 'rw'.
			
			return 'rw';
		}
	}

	# first check if there are permissions set on this item directly.
	#
	if($PREF{enable_old_custom_folder_permissions} =~ /yes/i)
	{
		if($PREF{user_perms_override_group_perms_for_same_folder} =~ /yes/i)
		{
			foreach my $level ('rw', 'ro')	{ return $level if id_has_direct_access_to_item('user', $level, $userid, $item); }
			foreach my $level ('rw', 'ro')	{ return $level if one_of_this_users_groups_has_direct_access_to_item($level, $userid, $item); }
		}
		else
		{
			foreach my $level ('rw', 'ro')	{ return $level if one_of_this_users_groups_has_direct_access_to_item($level, $userid, $item); }
			foreach my $level ('rw', 'ro')	{ return $level if id_has_direct_access_to_item('user', $level, $userid, $item); }
		}
	}
	else
	{
		my $user_read	= id_has_direct_access_to_item('user', 'read', $userid, $item)		? 'r' : '';
		my $user_write	= id_has_direct_access_to_item('user', 'write', $userid, $item)		? 'w' : '';
		my $user_denied	= id_has_direct_access_to_item('user', 'denied', $userid, $item)	? 'd' : '';
		my $user_perms	= $user_denied || "$user_read$user_write";

		my $group_read	= one_of_this_users_groups_has_direct_access_to_item('read', $userid, $item)	? 'r' : '';
		my $group_write	= one_of_this_users_groups_has_direct_access_to_item('write', $userid, $item)	? 'w' : '';
		my $group_denied= one_of_this_users_groups_has_direct_access_to_item('denied', $userid, $item)	? 'd' : '';
		my $group_perms	= $group_denied || "$group_read$group_write";

		my $active_direct_perms = '';
		if($PREF{user_perms_override_group_perms_for_same_folder} =~ /yes/i)
		{
			$active_direct_perms = $user_perms || $group_perms;
		}
		else
		{
			$active_direct_perms = $group_perms || $user_perms;
		}
		if($active_direct_perms) { return $active_direct_perms; }
	}

	# if we're still here, then there are no direct permissions set,
	# so find the closest inherited permissions.
	#
	my $closest_user_perms = find_closest_inherited_permissions_for_id('user', $userid, $item);
	my $closest_group_perms = find_closest_inherited_permissions_for_this_users_groups($userid, $item);
	
	my ($user_level, $depth_of_user_level) = ($closest_user_perms =~ /([a-z]+)(\d+)/);
	my ($group_level, $depth_of_group_level) = ($closest_group_perms =~ /([a-z]+)(\d+)/);

	if($closest_user_perms && $closest_group_perms)
	{
		return $depth_of_user_level < $depth_of_group_level ? $user_level : $group_level;
	}
	elsif($closest_user_perms)
	{
		return $user_level;
	}
	elsif($closest_group_perms)
	{
		return $group_level;
	}
	else
	{
		# No custom folder permissions have been set.  Only now do the userdir check, so that
		# the admin has the ability to set custom folder perms on individual userdir folders
		# if he wishes to override the default 'rw' perms that each userdir automatically has.
		#
		
		#if($PREF{userdir}   &&   $item =~ m!^/$PREF{userdir_folder_name}/$PREF{userdir}(/|$)!)
		#{
		#	return $PREF{default_userdir_folder_rights};
		#}
		#else
		#{
		#	return $PREF{default_folder_rights};
		#}
		
		if($PREF{enable_userdirs} =~ /yes/i)
		{
			if(this_is_the_userdir_folder($item))
			{
				# Special subgroup manager check: let SGMs have read access the root of the userdir folder
				# (subject to later checks in the file-list sub to restrict him to only his own sub-users).
				#
				return logged_in_user_is_subgroup_manager() ? 'r' : '';
			}
			else
			{
				my $readable = is_userdir_folder_that_this_user_can_read($item);
				my $writable = is_userdir_folder_that_this_user_can_write($item);
				if($readable && $writable)	{ return 'rw';	}
				elsif($readable)		{ return 'r';	}
				elsif($writable)		{ return 'w';	}
				else				{ return '';	}
			}
		}
		else
		{
			return $PREF{default_folder_rights};
		}

	}
}


# slashify($item) before calling.
sub one_of_this_users_groups_has_direct_access_to_item($$$)
{
	my ($level, $userid, $item) = @_;
	get_groups_where_user_is_member($userid);
	if(my $direct_access_gids = get_groups_with_direct_access_to_item($level, $item))
	{
		foreach my $gid (split(/,/, $direct_access_gids))
		{
			if($PREF{groups_where_user_is_member}{$userid}{gids}{$gid})
			{
				printd "one_of_this_users_groups_has_direct_access_to_item(): returning 1\n";
				return 1;
			}
		}
	}
}



# slashify($item) before calling.
sub find_closest_inherited_permissions_for_this_users_groups($$$)
{
	my ($userid, $item) = @_;
	get_groups_where_user_is_member($userid);
	my ($closest_depth, $closest_level) = ();
	foreach my $gid (keys %{$PREF{groups_where_user_is_member}{$userid}{gids}})
	{
		if(my $result = find_closest_inherited_permissions_for_id('group', $gid, $item))
		{
			my ($level,$depth) = ($result =~ /([a-z]+)(\d+)/);
			if($closest_depth !~ /^\d+$/ || $depth < $closest_depth)
			{
				$closest_depth = $depth;
				$closest_level = $level;
			}
		}
	}
	return $closest_level . $closest_depth;
}



# accepts a uid or a gid.
# slashify($item) before calling.
sub find_closest_inherited_permissions_for_id($$$)
{
	my ($type, $id, $item) = @_; # type is user/group.
	my $numlevels = 1;
	while($item =~ m![^/]!)
	{
		remove_deepest_level($item);

		if($PREF{enable_old_custom_folder_permissions} =~ /yes/i)
		{
			# since any given level (i.e. the level that $item is at now) can't
			# have both ro and rw set simultaneously, it doesn't matter what
			# order these return statements are in.
			return 'ro' . $numlevels if id_has_direct_access_to_item($type, 'ro', $id, $item);
			return 'rw' . $numlevels if id_has_direct_access_to_item($type, 'rw', $id, $item);
		}
		else
		{
			# read and write are no longer mutually exclusive, but they each are m.e. now
			# with denied.
			#
			my $read	= id_has_direct_access_to_item($type, 'read', $id, $item)	? 'r' : '';
			my $write	= id_has_direct_access_to_item($type, 'write', $id, $item)	? 'w' : '';
			my $denied	= id_has_direct_access_to_item($type, 'denied', $id, $item)	? 'd' : '';
			if($read || $write || $denied)
			{
				if($denied)	{ return "$denied"	. $numlevels;	}
				else		{ return "$read$write"	. $numlevels;	}
			}
		}

		$numlevels++;
	}
	return undef;
}


# accepts a uid or a gid.
# slashify($item) before calling.
sub id_has_direct_access_to_item($$$$)
{
	my ($type, $level, $id, $item) = @_; # type is user/group, level is ro/rw (oldsystem) or read/write/denied (newsystem).
	if($type eq 'user' && $id =~ /^-/)
	{
		# If the ID we received is a userid, and it is negative, then we are
		# not integrated with UserBase, which means there aren't really any
		# users, only groups (and only 3 groups at that).  So we do the perms
		# based on groups in this case, thus the answer is "no" here.

		return 0;
	}
	my $id_list = get_ids_with_direct_access_to_item($type, $level, $item);
	my $retval = $id_list =~ /(^|,)$id(,|$)/ ? 1 : 0;

	printd "id_has_direct_access_to_item(): returning $retval\n";
	return $retval;
}


# assumes input ends with a slash and returns it that way.
sub remove_deepest_level
{
	s!/+$!! for @_;
	s![^/]+$!! for @_;
	for(@_) { $_ = '/' unless $_; }
}
	


# slashify($item) before calling.
sub logged_in_user_has_permission_to_view_perms($)
{
	#printd "logged_in_user_has_permission_to_view_perms('$_[0]')\n";

	my $item = shift;

	if($PREF{admin_is_logged_in})
	{
		return 1;
	}
	elsif($PREF{permissions_required_to_view_permissions} =~ /^none$/i)
	{
		return 1;
	}
	elsif($PREF{permissions_required_to_view_permissions} =~ /^(ro|rw|r|w)$/i)
	{
		return 1 if get_effective_folder_permissions($PREF{logged_in_username},$item) =~ /$PREF{permissions_required_to_view_permissions}/i;
	}
	else
	{
		return 0;
	}
}


# slashify($item) before calling.
sub logged_in_user_has_permission_to_change_perms($)
{
	#printd "logged_in_user_has_permission_to_change_perms('$_[0]')\n";

	my $item = shift;

	if($PREF{admin_is_logged_in})
	{
		return 1;
	}
	elsif($PREF{users_can_change_perms_in_own_userdir} =~ /yes/i)
	{
		# TODO: should we remove userbase_available() from this check, so this works for serial-userdirs too?
		#
		return 1 if (userbase_available()   &&   $PREF{userdir}   &&   $item =~ m!^/$PREF{userdir_folder_name}/$PREF{userdir}(/|$)!);
	}
	else
	{
		return 0;
	}
}


# returns a list of uids.
sub get_users_with_inherited_access_to_item($$)
{
	return unless userbase_available(); # no users, and thus no uids, without userbase.

	my $type = shift; # rw or ro (oldsystem); or read/write/denied (newsystem).
	my $item = shift;
	sql_untaint($item);
	my $users = ();

	# first remove the deepest folder name to exclude direct-access users.
	remove_deepest_level($item);

	# try parents recursively.
	while($item =~ m!/!)
	{
		$users .= ',' . enc_sql_select("SELECT `${type}users` FROM `$PREF{perms_table}` WHERE `path` = '$item'");
		last if $item eq '/';
		remove_deepest_level($item);
	}

	decommaify($users);
	return $users;
}


# returns a list of ids.
# slashify($item) before calling.
sub get_ids_with_direct_access_to_item($$$)
{
	my $type = shift; # user or group.
	my $level = shift; # rw or ro (oldsystem); or read/write/denied (newsystem).
	my $item = shift;

	return if ($type eq 'user' && !userbase_available()); # no users, and thus no uids, without userbase.

	sql_untaint($item);
	my $ids = enc_sql_select("SELECT `${level}${type}s` FROM `$PREF{perms_table}` WHERE `path` = '$item'");
	decommaify($ids);
	return $ids;
}



# returns a list of uids.
# slashify($item) before calling.
sub get_users_with_direct_access_to_item($$)
{
	return unless userbase_available(); # no users, and thus no uids, without userbase.

	my $type = shift; # rw or ro (oldsystem); or read/write/denied (newsystem).
	my $item = shift;
	sql_untaint($item);
	my $users = enc_sql_select("SELECT `${type}users` FROM `$PREF{perms_table}` WHERE `path` = '$item'");
	decommaify($users);
	return $users;
}



# returns a list of gids.
# slashify($item) before calling.
sub get_groups_with_inherited_access_to_item($$)
{
	my $type = shift; # rw or ro (oldsystem); or read/write/denied (newsystem).
	my $item = shift;
	sql_untaint($item);
	my $groups = ();

	# first remove the deepest folder name to exclude direct-access groups.
	remove_deepest_level($item);

	# try parents recursively.
	while($item =~ m![^/]!)
	{
		$groups .= ',' . enc_sql_select("SELECT `${type}groups` FROM `$PREF{perms_table}` WHERE `path` = '$item'");
		remove_deepest_level($item);
	}

	decommaify($groups);
	return $groups;
}


# returns a list of gids.
# slashify($item) before calling.
sub get_groups_with_direct_access_to_item($$)
{
	my $type = shift; # rw or ro (oldsystem); or read/write/denied (newsystem).
	my $item = shift;
	sql_untaint($item);
	my $groups = enc_sql_select("SELECT `${type}groups` FROM `$PREF{perms_table}` WHERE `path` = '$item'");
	decommaify($groups);
	return $groups;
}



sub remove_nonnegative_ids
{
	s/(^|,)\d+//g for @_;
}


sub update_custom_folder_perms_for_dir($$)
{
	my ($old_dir_name, $new_dir_name) = @_;
	slashify($old_dir_name, $new_dir_name);
	sql_untaint($old_dir_name, $new_dir_name);
	my $errors = ();

	foreach my $table ($PREF{old_perms_table}, $PREF{new_perms_table})
	{
		my ($id,$path) = ();
		my $sth = $PREF{dbh}->prepare("SELECT `id`,`path` from `$table` WHERE `path` LIKE '$old_dir_name%'");
		if($sth->execute())
		{
			$sth->bind_columns(\$id,\$path);
			while($sth->fetchrow_arrayref)
			{
				my $newpath = $path;
				$newpath =~ s!^$old_dir_name!$new_dir_name!;
				my $sth_inner = $PREF{dbh}->prepare("UPDATE `$table` SET `path`='$newpath' WHERE `id`=$id");
				$sth_inner->execute() or $errors .= qq`update_custom_folder_perms_for_dir() failed: $DBI::errstr\n<br /><br />\n`;
			}
		}
		else
		{
			$errors = qq`update_custom_folder_perms_for_dir() failed: $DBI::errstr\n<br /><br />\n`;
		}
	}

	return $errors;
}


sub copy_custom_folder_perms($$)
{
	my ($src,$dst) = @_;
	my $src_local = ($src =~ m!^$PREF{DOCROOT}/*$PREF{uploaded_files_dir}(.+)!)[0];
	my $dst_local = ($dst =~ m!^$PREF{DOCROOT}/*$PREF{uploaded_files_dir}(.+)!)[0];
	slashify($src_local, $dst_local);
	die_unless_sqlsafe($src_local, $dst_local);
	#print STDERR "src_local=$src_local, dst_local=$dst_local\n";

	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{perms_table}` WHERE `path` = '$src_local'"))
	{
		create_custperms_record_for_item_if_DNE($dst_local);
		my $perms = enc_sql_select_multi("SELECT * FROM `$PREF{perms_table}` WHERE `path` = '$src_local'");
		foreach my $perm (sort keys %{$$perms{1}})
		{
			next if ($perm eq 'id') || ($perm eq 'path');
			my $statement = "UPDATE `$PREF{perms_table}` SET `$perm` = '$$perms{1}{$perm}' WHERE `path` = '$dst_local'";
			my $success = enc_sql_update($statement);
			die_nice("Error: SQL returned '$success' instead of '1' while updating perms.  SQL was: [[$statement]]") unless $success == 1;
		}
	}
}


sub delete_custom_perms_for_folder($)
{
	return unless custom_folder_perms_enabled();
	my $dir = shift;
	my $dir_local = ($dir =~ m!^$PREF{DOCROOT}/*$PREF{uploaded_files_dir}(.+)!)[0];
	slashify($dir_local);
	die_unless_sqlsafe($dir_local);
	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{perms_table}` WHERE `path` = '$dir_local'"))
	{
		enc_sql_delete("DELETE FROM `$PREF{perms_table}` WHERE `path`='$dir_local' LIMIT 1");
	}
}


sub get_groups_where_user_is_member
{
	printd "get_groups_where_user_is_member('$_[0]')\n";

	my $userid = shift;
	return if $PREF{groups_where_user_is_member}{$userid}; # already done for this user.

	if($PREF{integrate_with_userbase} =~ /yes/i || $PREF{integrate_with_userbase_method_b} =~ /yes/i)
	{
		# We do need database access for this, which integrate_with_userbase_method_b does
		# not necessarily provide, but it is provided by the custom_folder_perms feature,
		# which is the only time this function is called.

		my $username = get_user_name($userid);
		my ($id,$group,%groups) = ('', '', ());

		check_id_for_sql_safeness($userid);

		my $sth = $PREF{dbh}->prepare("SELECT `id`, `group` FROM `$PREF{group_table}` WHERE `members` REGEXP '(^|,)$userid(,|\$)'");
		$sth->execute() or die_nice("$0: get_groups_where_user_is_member('$userid') failed: $DBI::errstr\n");
		$sth->bind_columns(\$id, \$group);
		while($sth->fetchrow_arrayref)
		{
			$PREF{groups_where_user_is_member}{$username}{gids}{$id} = 1;
			$PREF{groups_where_user_is_member}{$username}{groupnames}{$group} = 1;
			$PREF{groups_where_user_is_member}{$userid}{gids}{$id} = 1;
			$PREF{groups_where_user_is_member}{$userid}{groupnames}{$group} = 1;
		}

		# Every account automatically belongs to the public group:
		#
		my $public_group_id = get_group_id($PREF{public_group_name});
		$PREF{groups_where_user_is_member}{$username}{gids}{$public_group_id} = 1;
		$PREF{groups_where_user_is_member}{$username}{groupnames}{$PREF{public_group_name}} = 1;
		$PREF{groups_where_user_is_member}{$userid}{gids}{$public_group_id} = 1;
		$PREF{groups_where_user_is_member}{$userid}{groupnames}{$PREF{public_group_name}} = 1;

		# Every logged-in account automatically belongs to the member group:
		#
		if($PREF{member_is_logged_in})
		{
			my $member_group_id = get_group_id($PREF{member_group_name});
			$PREF{groups_where_user_is_member}{$username}{gids}{$member_group_id} = 1;
			$PREF{groups_where_user_is_member}{$username}{groupnames}{$PREF{member_group_name}} = 1;
			$PREF{groups_where_user_is_member}{$userid}{gids}{$member_group_id} = 1;
			$PREF{groups_where_user_is_member}{$userid}{groupnames}{$PREF{member_group_name}} = 1;
		}
	}
	else
	{
		# All users are members of the public group (-1):

		my $public_group_id = get_group_id($PREF{public_group_name});
		$PREF{groups_where_user_is_member}{$userid}{gids}{$public_group_id} = 1;
		$PREF{groups_where_user_is_member}{$userid}{groupnames}{$PREF{public_group_name}} = 1;


		my $member_group_id = get_group_id($PREF{member_group_name});
		if($userid == -2) # member.
		{
			$PREF{groups_where_user_is_member}{$userid}{gids}{$member_group_id} = 1;
			$PREF{groups_where_user_is_member}{$userid}{groupnames}{$PREF{member_group_name}} = 1;
		}

		my $admin_group_id = get_group_id($PREF{admin_group_name});
		if($userid == -3) # admin.
		{
			$PREF{groups_where_user_is_member}{$userid}{gids}{$member_group_id} = 1;
			$PREF{groups_where_user_is_member}{$userid}{groupnames}{$PREF{member_group_name}} = 1;

			$PREF{groups_where_user_is_member}{$userid}{gids}{$admin_group_id} = 1;
			$PREF{groups_where_user_is_member}{$userid}{groupnames}{$PREF{admin_group_name}} = 1;
		}
	}
}


sub ftp_files_to_another_server
{
	my @files_to_send = @_;
	my @ftp_errors = ();

	use Net::FTP;

	my $ftp = Net::FTP->new($PREF{ftp_server}, Debug => 0, Passive => $PREF{use_passive_ftp_mode} =~ /yes/i ? 1 : 0) or push @ftp_errors, "$PREF{internal_appname}: cannot connect to FTP server '$PREF{ftp_server}': $@\n";
	return @ftp_errors if @ftp_errors;

	$ftp->login($PREF{ftp_username},$PREF{ftp_password}) or push @ftp_errors, "$PREF{internal_appname}: FTP: Cannot login: ", $ftp->message;
	return @ftp_errors if @ftp_errors;

	#printd "PWD: " . $ftp->pwd() or "$PREF{internal_appname}: FTP: Cannot get working directory ", $ftp->message);
	#
	#for($ftp->ls())
	#{
	#	printd "FTP item: $_";
	#}

	foreach my $file_with_localpath (@files_to_send)
	{
		my ($localpath, $leafname) = ($file_with_localpath =~ m!(.+)/(.+)!);
		$leafname = $file_with_localpath unless $leafname;

		my $file_here  = $PREF{uploaded_files_realpath} . '/' . $file_with_localpath;
		condense_slashes('leave_leading_UNC', $file_here);

		if($localpath   &&   $PREF{create_subdirs_on_ftp_server} =~ /yes/i)
		{
			$localpath = $PREF{base_path_on_ftp_server} . '/' . $localpath;
			condense_slashes($localpath);

			printd "about to mkdir($localpath)";
			$ftp->mkdir($localpath, 1) or push @ftp_errors, "$PREF{internal_appname}: FTP: Cannot create directory '$localpath': ", $ftp->message;
			printd "finished mkdir($localpath), message is " . $ftp->message;

			$ftp->cwd($localpath) or push @ftp_errors, "$PREF{internal_appname}: FTP: Cannot cwd into path '$localpath': ", $ftp->message;
			printd "cwd()'d to '$localpath' successfully";
		}
		else
		{
			$ftp->cwd($PREF{base_path_on_ftp_server}) or push @ftp_errors, "$PREF{internal_appname}: FTP: Cannot cwd into base path '$PREF{base_path_on_ftp_server}': ", $ftp->message;
			printd "cwd()'d to '$PREF{base_path_on_ftp_server}' successfully";
		}

		my $ascii = 0;
		foreach my $extension (split(/[\s,]+/, $PREF{extensions_to_use_ascii_mode_for}))
		{
			$ascii = 1 if $leafname =~ /$extension$/i;
		}
		if($ascii)	{ printd "enabling ASCII transfer mode";	$ftp->ascii();	}
		else		{ printd "enabling BINARY transfer mode";	$ftp->binary();	}

		printd "about to put($file_here)";
		my $put_error = 0;
		if(!$ftp->put($file_here))
		{
			$put_error = 1;
			push @ftp_errors, "$PREF{internal_appname}: FTP: Cannot put file '$file_here' onto FTP server: ", $ftp->message;
		}

		if($PREF{delete_files_on_this_server_after_successful_ftp} =~ /yes/i   &&   !$put_error)
		{
			unlink($file_here) or push @ftp_errors, "$PREF{internal_appname}: FTP: could not delete file '$file_here' after successful FTP transfer: $!";
		}
	}

	$ftp->quit;
	return @ftp_errors;
}


sub extract_archive($$)
{
	my $archive_file = shift;
	my $output_dir = shift;

=item
	use Archive::Extract;

	my $ae = Archive::Extract->new( archive => $archive_file );
	my $success = 0;

	if($output_dir)
	{
		$success = $ae->extract( to => $output_dir );
	}
	else
	{
		# extract to cwd().
		$success = $ae->extract;
	}

	return ($success, $ae->error);
=cut
}


# EB, FC
sub get_human_test_form
{
	#my ($number) = $PREF{human_test_is_invisible} =~ /yes/i ? ($PREF{humantest_code}) : (rand() =~ /(\d{$PREF{human_test_num_digits}})/);
	my $number = $PREF{humantest_code};
	die_nice "problem creating number; got '$number'." unless $number =~ /^\d{$PREF{human_test_num_digits}}$/;

	my $hash = md5_hex($number . $PREF{human_test_salt_value});
	my ($width, $height) = create_human_test_image($number,$hash);
	my $dims = $PREF{netpbm_command_for_humantest} ? '' : qq`width="$width" height="$height"`;

	my $image_leafname = $hash . '.jpg';
	my $dir_url = $PREF{human_test_image_directory___url};
	$dir_url .= '/' unless $dir_url =~ m!/$!;

	my $style = $PREF{human_test_is_invisible} =~ /yes/i ? qq`style="display: none;"` : '';

	my $output	= qq``
			. qq`<div id="fc-humantest" $style>$TEXT{Human_test__type_the_numbers_in_the_box_}`
			. qq`<br /><img src="$dir_url$image_leafname" id="fcht0" $dims alt="human test image" style="margin: $PREF{human_test_margin};" />`
			. qq`<input type="hidden" name="fcht1" id="fcht1" value="$hash" />`
			. qq`<br /><input type="text" name="fcht2" id="fcht2" maxlength="300" class="default text required" />`
			. qq`</div>`
			. qq`\n`;
}


sub create_human_test_image($$)
{
	my ($number,$hash) = @_;

	my $dir_url	= $PREF{human_test_image_directory___url};
	my $dir_real	= $PREF{human_test_image_directory___real};
	$dir_url	.= '/' unless $dir_url =~ m!/$!;
	$dir_real	.= '/' unless $dir_real =~ m!/$!;

	my $image_leafname = $hash . '.jpg';
	my $image_filename = $dir_real . $image_leafname;

	my ($width,$height) = ($PREF{human_test_image_width},$PREF{human_test_image_height});
	my $wave_amplitude = 4;
	my $wavelength = $width/2;
	my $final_width = $width;
	my $final_height = $height;

	my $method_used = '';
	if($PREF{netpbm_command_for_humantest})
	{
		printd qq`create_human_test_image(): using netpbm\n`;
		$method_used = 'netpbm';

		my $cmd = $PREF{netpbm_command_for_humantest};
		$cmd =~ s!%%output_filename%%!$image_filename!g;
		$cmd =~ s!%%random_number%%!$number!g;
		my ($success,$msg) = enc_sys_call($cmd);
		unless($success) { die_nice(qq`failed: $msg`); }
	}
	elsif($PREF{convert_available} =~ /yes/i   &&   $PREF{try_to_use_convert_for_humantest} =~ /yes/i)
	{
		printd qq`create_human_test_image(): using convert\n`;
		$method_used = 'convert';

		$final_width = $width + $PREF{human_test_border_size} * 2;
		$final_height = $height + $wave_amplitude * 2 + $PREF{human_test_border_size} * 2;

		my $cmd = qq`$PREF{convert_command} -background $PREF{human_test_background_color} -fill $PREF{human_test_text_color} -size ${width}x$height -pointsize $PREF{human_test_text_size} -gravity center -wave ${wave_amplitude}x$wavelength -border $PREF{human_test_border_size} -bordercolor $PREF{human_test_border_color} -quality 85 label:$number "$image_filename"`;
		my ($success,$msg) = enc_sys_call($cmd);
		unless($success) { die_nice(qq`failed: $msg`); }
	}
	elsif($PREF{imagemagick_available}   &&   $PREF{try_to_use_imagemagick_for_humantest} =~ /yes/i)
	{
		$method_used = 'ImageMagick';

		$final_width = $width + $PREF{human_test_border_size} * 2;
		$final_height = $height + $wave_amplitude * 2 + $PREF{human_test_border_size} * 2;

		my $image = Image::Magick->new;

		$image->Set(size=>"${width}x$height");
		$image->ReadImage("xc:$PREF{human_test_background_color}");

		$image->Annotate(font=>$PREF{human_test_font_name}, fill=>$PREF{human_test_text_color}, pointsize=>$PREF{human_test_text_size}, gravity=>'center', text=>$number);
		$image->Wave(amplitude=>$wave_amplitude, wavelength=>$wavelength);
		$image->Border(color=>$PREF{human_test_border_color}, width=>$PREF{human_test_border_size}, height=>$PREF{human_test_border_size});
		$image->Set(quality=>85);

		my $return_value = $image->Write($image_filename); # creates the image file, but still returns undef??
		if(! -e $image_filename)
		{
			die_nice("couldn't write image: $! (return value from \$image->Write() was '$return_value')\n");
		}
	}
	elsif(gd_is_available()   &&   $PREF{try_to_use_gd_for_humantest} =~ /yes/i)
	{
		$method_used = 'GD';

		my $img = GD::Simple->new($width,$height);

		$img->bgcolor($PREF{human_test_background_color});
		$img->fgcolor($PREF{human_test_border_color});
		$img->setThickness($PREF{human_test_border_size});
		$img->rectangle(0,0,$width-1,$height-1) if $PREF{human_test_border_size};
		$img->fgcolor($PREF{human_test_text_color});
		$img->fontsize($PREF{human_test_text_size});
		$img->moveTo(5,15);
		$img->string($number);

		open(IMAGEFH, ">$image_filename") or die_nice("$PREF{internal_appname}: couldn't create human test image '$image_filename': $!\n");
		my $fh = \*IMAGEFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		flock $fh, 2;
		seek $fh, 0, 0;
		print $fh $img->jpeg(85);
		close $fh or die_nice("$PREF{internal_appname}: couldn't close image '$image_filename': $!\n");
	}
	else
	{
		die_nice "no image-creating library available...\n";
	}

	if(! -e $image_filename)
	{
		die_nice qq`image file does not exist after we attempted to create it.  Method used was: $method_used.  <br /><br />\n\n($image_filename)`;
	}
	if(! -s $image_filename)
	{
		die_nice qq`image file has a filesize of zero after we attempted to create it.  Method used was: $method_used.  <br /><br />\n\n($image_filename)`;
	}

	chmod $PREF{writable_file_perms}, $image_filename;

	return ($final_width, $final_height);
}


# EB, FC
sub do_human_test
{
	my $original_hash = shift;
	my $user_input = shift;
	printd "do_human_test: user_input=$user_input, original_hash=$original_hash";

	my $user_hash = md5_hex($user_input . $PREF{human_test_salt_value});
	printd "do_human_test: human_test_salt_value=$PREF{human_test_salt_value}, user_hash=$user_hash";

	# Also make sure that the image file actually (still) exists, to
	# protect against replay attacks.
	#
	my $dir_real = $PREF{human_test_image_directory___real};
	$dir_real .= '/' unless $dir_real =~ m!/$!;
	my $image_leafname = $user_hash . '.jpg';
	my $image_filename = $dir_real . $image_leafname;
	#printd "human: image_filename=$image_filename";
	printd "human: file exists = " . -e $image_filename;

	my $passed_test = ($user_hash eq $original_hash   &&   -e $image_filename);
	printd "do_human_test(): passed=$passed_test";
	return $passed_test;
}


sub show_all_permissions()
{
	exit_with_error("Access denied: insufficient permissions to access this page.") unless $PREF{admin_is_logged_in};
	exit_with_error("This feature is not enabled.") unless custom_folder_perms_enabled();


	start_html_output("All permissions");
	print qq`<p>This page shows all the permissions that have been <i>explicitly</i> set, for all users/groups on all folders.&nbsp; It does not show any implicit permissions, which means that inherited permissions are not shown, and permissions that users have via their group memberships are not shown.</p>\n`;

	my $letter = $qs =~ /(?:^|&)which=([a-z])(?:&|$)/i ? $1 : $qs =~ /(?:^|&)which=all(?:&|$)/i ? 'all' : 'all';


	print qq`<div id="itemperms" class="enc_tbl"><table>\n`;
	print qq`<tr><th>Name</th><th>Folder</th><th>Access<br />Level</th></tr>\n`;

	my $i = 0;
	my $some_rows_displayed = 0;
	my @levels = $PREF{enable_old_custom_folder_permissions} =~ /yes/i ? ('ro', 'rw') : ('read', 'write', 'denied');
	if(userbase_available())
	{
		foreach my $type ('Group', 'User')
		{
			my $colname = $type eq 'User' ? 'username' : 'group';
			my $tablename = $PREF{lc($type) . '_table'};
			my $restriction = ($letter eq 'all' || !userbase_available()) ? undef : " WHERE LOWER(`$colname`) LIKE LOWER('$letter%') ";

			my ($id,$name) = ();
			my $sth = $PREF{dbh}->prepare("SELECT `id`,`$colname` FROM `$tablename` ${restriction} ORDER BY `$colname`");
			$sth->execute() or die_nice("$PREF{internal_appname}: show_all_permissions(): failed while getting IDs and ${type}s: $DBI::errstr\n");
			$sth->bind_columns(\$id,\$name);
			while($sth->fetchrow_arrayref)
			{
				next if $type eq 'Group' && $name =~ /^$PREF{admin_group_name}$/i;

				my $row_class = oddeven($i);
				my $display_name = $type eq 'User' ? $name : $name =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i ? "<strong>$name</strong>" : $name;
				print qq`\n<tr class="$row_class"><td class="name">$type <a href="$PREF{login_url_qsready}action=edit` . lc($type) . qq`&amp;id=$id">$display_name</a></td><td></td><td></td></tr>`;
				$some_rows_displayed = 0;

				foreach my $level (@levels)
				{
					my $path = '';
					my $sth2 = $PREF{dbh}->prepare("SELECT `path` FROM `$PREF{perms_table}` WHERE `${level}" . lc($type) . "s` REGEXP '(^|,)$id(,|\$)' ORDER BY `path`");
					$sth2->execute() or die_nice("$PREF{internal_appname}: show_all_permissions(): failed while getting paths from perms table for id=$id: $DBI::errstr\n");
					$sth2->bind_columns(\$path);
					while($sth2->fetchrow_arrayref)
					{
						print qq`\n<tr class="$row_class"><td class="name"></td><td class="path"><a href="$PREF{here_filelist_qsready}action=listfiles&amp;path=$path">$path</a></td><td><a href="$PREF{here_qsready}action=showperms&amp;item=$path">` . $level . qq`</a></td></tr>`;
						$some_rows_displayed = 1;
					}
				}

				print qq`\n<tr class="$row_class"><td></td><td class="none">(none)</td><td></td></tr>` unless $some_rows_displayed;
			}
		}
	}
	else
	{
		my %groupname = (-1 => $PREF{public_group_name}, -2 => $PREF{member_group_name});

		foreach my $id (-2, -1)
		{
			my $row_class = oddeven($i);
			print qq`\n<tr class="$row_class"><td class="name">Group $groupname{$id}</td><td></td><td></td></tr>`;
			$some_rows_displayed = 0;

			foreach my $level (@levels)
			{
				my $path = '';
				my $sth2 = $PREF{dbh}->prepare("SELECT `path` FROM `$PREF{perms_table}` WHERE `${level}groups` REGEXP '(^|,)$id(,|\$)' ORDER BY `path`");
				$sth2->execute() or die_nice("$PREF{internal_appname}: show_all_permissions(): failed while getting paths from perms table for id=$id: $DBI::errstr\n");
				$sth2->bind_columns(\$path);
				while($sth2->fetchrow_arrayref)
				{
					print qq`\n<tr class="$row_class"><td class="name"></td><td class="path"><a href="$PREF{here_filelist_qsready}action=listfiles&amp;path=$path">$path</a></td><td><a href="$PREF{here_qsready}action=showperms&amp;item=$path">` . $level . qq`</a></td></tr>`;
					$some_rows_displayed = 1;
				}
			}

			print qq`\n<tr class="$row_class"><td></td><td class="none">(none)</td><td></td></tr>` unless $some_rows_displayed;
		}
	}

	print qq`\n</table></div>\n`;


	if(userbase_available())
	{
		print qq`<p class="itemperms-letters">\nFilter list:<br /><br /><a href="$PREF{here_qsready}action=showallperms&amp;which=all"` . ('all' eq lc($letter) ? ' class="current"' : undef) . qq`>All</a>`;
		foreach my $char ('A'..'Z')
		{
			print qq`<a href="$PREF{here_qsready}action=showallperms&amp;which=$char"` . ($char eq uc($letter) ? ' class="current"' : undef) . qq`>$char</a>`;
		}
		print qq`\n</p>`;
	}


	finish_html_output();
}


sub show_custom_page($)
{
	my $page = shift;

	my $allowed = 0;
	foreach my $group (split(/\s*,\s*/, $PREF{custom_pages}{$page}{groups_allowed_to_view}))
	{
		$allowed = 1 if user_is_member_of_group($PREF{logged_in_userid}, $group);
	}
	exit_with_needprivs() unless $allowed;

	#$PREF{on_page} = 'custpage_' . $page;   # TODO: this breaks the styling, because we're currently basing a lot of styling on #defaultpage, which we should change.
	$PREF{on_a_wide_page} = $PREF{custom_pages}{$page}{wide_page} =~ /yes/i;

	if(exists $PREF{custom_pages}{$page}{inpage_title}) { $PREF{title} = $PREF{custom_pages}{$page}{inpage_title}; delete $PREF{"title_$PREF{on_page}"} if exists $PREF{"title_$PREF{on_page}"}; }
	$PREF{titlebar_title} = $PREF{custom_pages}{$page}{titlebar_title} if exists $PREF{custom_pages}{$page}{titlebar_title};

	if($PREF{custom_pages}{$page}{type} eq 'static')
	{
		start_html_output($PREF{custom_pages}{$page}{title});
		print $PREF{custom_pages}{$page}{content};
		finish_html_output();
	}
	elsif($PREF{custom_pages}{$page}{type} eq 'database')
	{
		my $content = $PREF{custom_pages}{$page}{content};
		my (%fields,%fields_by_name) = ();
		
		# Create viewerprefname prefs for the get_database_output() function from the custom_pages settings.
		# This means anything that's supported via the viewerprefname syntax can be used via the custom_pages
		# settings.
		#
		my $viewerprefname = 'custpage_' . $page;
		foreach my $setting (sort keys %{$PREF{custom_pages}{$page}})
		{
			next if $setting =~ /^(type|content)$/;
			if($setting =~ /^field_(\d+)_name$/)
			{
				my $num = $1;
				$PREF{custom_pages}{$page}{$setting} =~ s!\W!_!g;
				$fields{$num}{name} = $PREF{custom_pages}{$page}{$setting};
				$fields_by_name{   $PREF{custom_pages}{$page}{$setting}   } = 1;
			}
			elsif($setting =~ /^field_(\d+)_type$/)
			{
				$fields{$1}{type} = $PREF{custom_pages}{$page}{$setting};
			}
			else
			{
				$PREF{"${viewerprefname}_${setting}"} = $PREF{custom_pages}{$page}{$setting};
			}
		}

		my %allowed_to = ();
		foreach my $action ('view', 'create', 'edit', 'delete', 'search')
		{
			foreach my $group (split(/\s*,\s*/, $PREF{custom_pages}{$page}{"groups_allowed_to_${action}"}))
			{
				$allowed_to{$action} = $PREF{"${viewerprefname}_allowed_to_${action}"} = 1 if user_is_member_of_group($PREF{logged_in_userid}, $group);
			}
		}



		my $table = $PREF{custom_pages}{$page}{table_name};
		if($PREF{custom_pages}{$page}{create_table_if_necessary} =~ /yes/i)
		{
			unless(db_table_exists($table))
			{
				printd "table '$table' does not exist; attempting to create it now.";

				my $statement =	  "CREATE TABLE `$table` ("
						. " `id` BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY, ";

				foreach my $fieldnum (sort keys %fields)
				{
					$statement .= " `$fields{$fieldnum}{name}` $fields{$fieldnum}{type}, "
				}
				$statement =~ s/,\s*$/ /;
				
				$statement .= ")";
				
				my $sth = $PREF{dbh}->prepare($statement);
				$sth->execute() or die_nice("couldn't create table '$table': $DBI::errstr");

				printd "created table '$table' successfully.";
			}

			foreach my $fieldnum (sort keys %fields)
			{
				if( ! db_column_exists($fields{$fieldnum}{name}, $table) )
				{
					my $sth = $PREF{dbh}->prepare("ALTER TABLE `$table` ADD `$fields{$fieldnum}{name}` $fields{$fieldnum}{type};");
					$sth->execute() or die_nice "could not add '$fields{$fieldnum}{name}' column to table '$table': $DBI::errstr\n";
					enc_warn "added column '$fields{$fieldnum}{name}' to table '$table'.";
				}

				if(field_datatype_has_changed($table,$fields{$fieldnum}{name},$fields{$fieldnum}{type})   &&   $PREF{custom_pages}{$page}{destroy_data_if_necessary} =~ /yes/i)
				{
					my $statement = "ALTER TABLE `$table` MODIFY `$fields{$fieldnum}{name}` $fields{$fieldnum}{type}";
					my $sth = $PREF{dbh}->prepare($statement);
					$sth->execute() or exit_with_error("error while executing SQL statement [[ $statement ]]: $DBI::errstr\n");
					enc_warn "changed column '$fields{$fieldnum}{name}' to type '$fields{$fieldnum}{type}'.";
				}
			}
			
			my $fields_already_in_db = get_db_colnames($table);
			foreach my $field (split(/,/, $fields_already_in_db))
			{
				next if $field eq 'id'; # never delete our built-in id field.
				unless($fields_by_name{$field})
				{
					if($PREF{custom_pages}{$page}{destroy_data_if_necessary} =~ /yes/i)
					{
						encdebug "Removing field '$field' from table '$table' because it's not in the prefs for this custom page.";
						my $sth = $PREF{dbh}->prepare("ALTER TABLE `$table` DROP COLUMN `$field`");
						$sth->execute() or die_nice(qq`could not drop field "$field" from table "$table": $DBI::errstr\n`);
					}
					else
					{
						encdebug "Field '$field' from table '$table' is not in the prefs for this custom page, but we won't remove it because the destroy_data_if_necessary pref is not enabled.";
					}
				}
			}
		}




		# Nothing below here should need to be edited in most cases:
		#
		# Call get_database_data() before starting any output in case we were POSTed
		# to and therefore we need to redirect instead of printing output.
		#
		my $output = get_database_data($table, $viewerprefname, $allowed_to{view}, $allowed_to{create}, $allowed_to{edit}, $allowed_to{delete});
		start_html_output();
		$content =~ s!%%database_viewer%%!$output!;
		print $content;
		finish_html_output();
	}
}


##############################################################################
### Shared-FC: ###############################################################
##############################################################################


sub load_external_prefs
{
	my ($script_basename) = ($ENV{SCRIPT_NAME} =~ m!.*?[/\\]?([^/\\]+)\.[^/\\\.]+!);
	my ($script_dirname) = ($ENV{SCRIPT_NAME} =~ m!^(.+)/.*?$!);
	my $prefs_basename = $_[0] eq 'use_internal_filename' ? $PREF{internal_filename} : $script_basename;

	my @prefs_files = (	"encodable_shared_prefs___overrideable",
				"${prefs_basename}_shared_prefs___overrideable",
				"${prefs_basename}_prefs_new",
				"${prefs_basename}_prefs",
				"${prefs_basename}_prefs_extra",
				"encodable_shared_prefs___nonoverrideable",
				"${prefs_basename}_shared_prefs___nonoverrideable",
	);

	my $critical_prefs_loaded = 0;
	foreach my $prefs_file (@prefs_files)
	{
		for($prefs_file,
			"$PREF{DOCROOT}/cgi-bin/$prefs_file",		"$PREF{DOCROOT}/../cgi-bin/$prefs_file",
			"$PREF{DOCROOT}/cgi/$prefs_file",		"$PREF{DOCROOT}/../cgi/$prefs_file",
			"$PREF{DOCROOT}$script_dirname/$prefs_file",	"$PREF{DOCROOT}/..$script_dirname/$prefs_file",

			# Also try the parent dir, mainly because it's a likely place for any shared prefs files:
			"$PREF{DOCROOT}$script_dirname/../$prefs_file",	"$PREF{DOCROOT}/..$script_dirname/../$prefs_file", "../$prefs_file"
		)
		{
			if(my $file = -e "${_}.cgi" ? "${_}.cgi" : -e "${_}.pl" ? "${_}.pl" : '')
			{
				my $prefs_contents = ();
				open(IN,"<$file") or die_nice("couldn't open prefs file '$file': $!");
				flock IN, 1;
				seek IN, 0, 0;
				while(<IN>) { $prefs_contents .= $_; }
				close IN or die_nice("couldn't close prefs file '$file': $!");
				$prefs_contents =~ /(.*)/s;
				$prefs_contents = $1; # cheap untaint since this is our own config file.
				eval $prefs_contents; die_nice("Error processing your prefs file ('$file'): $@") if $@;
				$critical_prefs_loaded = 1 unless $file =~ /(_shared_prefs_|_prefs_extra)/;
				$PREF{loaded_prefs_files} .= "$file, ";
				last;
			}
		}
	}

	$PREF{loaded_prefs_files} =~ s!, $!!;

	if(!$critical_prefs_loaded)
	{
		if($_[0] ne 'use_internal_filename')
		{
			# First pass failed, so try again but use $PREF{internal_filename} as the prefs base.
			load_external_prefs('use_internal_filename');
		}
		else
		{
			# Second pass failed too; nothing else we can do.
			die_nice(
				"Error: couldn't find any prefs file to load.  You must put your $PREF{prefs_basename}_prefs.cgi file on the server with the $PREF{prefs_basename}.cgi file."
				. ($PREF{docroot_autodetection_error} ? qq` <br /><br />\nThis may be caused by or related to the following: $PREF{docroot_autodetection_error}` : '')
			);
		}
	}
}


sub load_userbase_prefs
{
	if($PREF{integrate_with_userbase} =~ /yes/i   &&   $PREF{internal_appname} !~ /^userbase$/i)
	{
		# Try to load UserBase prefs from userbase_prefs.cgi to avoid
		# having to specify common prefs twice.

		my %ub_pref_names = (
			database_hostname				=> 1,
			database_name					=> 1,
			database_username				=> 1,
			database_password				=> 1,
			dbi_connection_string				=> 1,

			time_offset					=> 1,
			hide_poweredby					=> 1,

			site_session_cookie				=> 1,
			login_url					=> 1,

			user_table					=> 1,
			group_table					=> 1,
			custom_field_table				=> 1, # for backwards compatibility.
			custom_field_list_table				=> 1,

			max_username_length				=> 1,
			max_groupname_length				=> 1,
			max_hashedpw_length				=> 1,

			allow_spaces_in_usernames			=> 1,
			allow_atsigns_in_usernames			=> 1,
			allow_dots_in_usernames				=> 1,
			allow_dashes_in_usernames			=> 1,

			allow_spaces_in_groupnames			=> 1,
			allow_atsigns_in_groupnames			=> 1,
			allow_dots_in_groupnames			=> 1,
			allow_dashes_in_groupnames			=> 1,

			make_usernames_case_insensitive			=> 1,
			make_passwords_case_insensitive			=> 1,

			idle_timeout					=> 1,
			num_days_rememberme_cookie_lasts		=> 1,
			enable_ip_address_restriction			=> 1,
			force_ip_address_restriction			=> 1,
			disable_ip_restriction_for_AOL_users		=> 1,
			enable_forced_password_change			=> 1,
			admins_can_be_forced_to_change_their_own_pws	=> 1,
			prevent_multiple_simultaneous_logons_per_username => 1,

			subgroup_groupname_suffix			=> 1,
			groups_that_can_manage_subgroup_users		=> 1,
			subgroup_owned_users_get_disabled_when_their_manager_does => 1,
		);

		my $prefs_basename = $PREF{userbase_prefs_file_basename};
		my @prefs_files = ("${prefs_basename}_prefs_new.cgi", "${prefs_basename}_prefs_new.pl", "${prefs_basename}_prefs.cgi", "${prefs_basename}_prefs.pl", "${prefs_basename}_prefs_extra.cgi", "${prefs_basename}_prefs_extra.pl");
		push (@prefs_files, $PREF{userbase_prefs_file}) if $PREF{userbase_prefs_file}; # so we can specify it manually, including full path, if necessary.
		push (@prefs_files, $PREF{userbase_prefs_file_extra}) if $PREF{userbase_prefs_file_extra};
		my $prefs_loaded = 0;
		foreach my $prefs_file (@prefs_files)
		{
			for(get_likely_prefs_file_locations($prefs_file))
			{
				if(-e $_)
				{
					my $file = $_;
					open(IN,"<$file") or die_nice("couldn't open prefs file '$file': $!");
					flock IN, 1;
					seek IN, 0, 0;
					while(<IN>)
					{
						if(/^\$PREF{(\w+)}\s*=\s*(.+)/)
						{
							my ($pref,$value) = ($1,$2);
							if($ub_pref_names{$pref})
							{
								if($value =~ /ENV\{SCRIPT_NAME\}/)
								{
									# In userbase_prefs.cgi, any use of $ENV{SCRIPT_NAME} is intended to mean '/cgi-bin/userbase.cgi'
									# (or whatever the path to userbase.cgi is), so we can't eval that here from FileChucker etc,
									# because then it will end up being '/cgi-bin/filechucker.cgi' instead.  (This is primarily a
									# problem for the $PREF{login_url} setting.)  So we'll try to figure out what the correct path to
									# userbase.cgi is, and if we can't, then we'll just skip this line from the userbase_prefs.cgi file.

									foreach my $likely_prefs_file (get_likely_prefs_file_locations($prefs_file))
									{
										my $script_name_full = $likely_prefs_file;
										$script_name_full =~ s!_prefs(_(new|extra))?!!; # remove the _prefs/_prefs_new/_prefs_extra from the prefs filename to get the script name.

										if(-e $script_name_full)
										{
											if($script_name_full =~ m!^$PREF{DOCROOT}(.+)!) # we only want the ones including the full path (i.e. just plain "userbase_prefs.cgi" doesn't help us here).
											{
												my $script_name = $1;
												$script_name =~ s!\.\./!!g; # in case this is one of the paths containing a "../", which is OK in the filesystem but not in URLs.

												my $updated_line = '';

												if(/^\$PREF{\w+}\s*=\s*\$ENV{SCRIPT_NAME};$/)
												{
													# If it's a simple "$PREF{foo} = $ENV{SCRIPT_NAME};" line, then we know we need to
													# add quotes around the $script_name value that we interpolate back into it:
													#
													$updated_line = $_; $updated_line =~ s!(%|\$)ENV\{SCRIPT_NAME\}!'$script_name'!g;
													eval $updated_line;
												}
												else
												{
													# Otherwise, the original line may or may not have had the ENV{SCRIPT_NAME} variable
													# within a quoted string, so we'll have to try this multiple ways:
													#
													$updated_line = $_; $updated_line =~ s!(%|\$)ENV\{SCRIPT_NAME\}!$script_name!g;
													eval $updated_line;
													if($@)
													{
														$updated_line = $_; $updated_line =~ s!(%|\$)ENV\{SCRIPT_NAME\}!'$script_name'!g;
														eval $updated_line;
														if($@)
														{
															$updated_line = $_; $updated_line =~ s!(%|\$)ENV\{SCRIPT_NAME\}!"$script_name"!g;
															eval $updated_line;
															if($@)
															{
																# We tried.
																die_nice(qq`Error processing your UserBase prefs file ('$file'): $@ <br /><br />\n\n(While processing line: "$updated_line") <br /><br />\n\nYou should get UserBase running first, then return here.`);
															}
														}
													}
												}
												last;
											}
										}
									}
								}
								else
								{
									eval $_; die_nice(qq`Error processing your UserBase prefs file ('$file'): $@ <br /><br />\n\n(While processing line: "$_") <br /><br />\n\nYou should get UserBase running first, then return here.`) if $@;
								}
							}
						}
						elsif(/^\$TEXT{(\w+)}\s*=\s*/)
						{
							eval $_; die_nice(qq`Error processing your UserBase prefs file ('$file'): $@ <br /><br />\n\n(While processing line: "$_") <br /><br />\n\nYou should get UserBase running first, then return here.`) if $@;
						}
					}
					close IN or die_nice("couldn't close prefs file '$file': $!");
					$PREF{loaded_userbase_prefs_files} .= "$file, ";
					$prefs_loaded = 1;
					last;
				}
			}
		}
		die_nice("Error: couldn't find any UserBase prefs file to load.  You must put your UserBase prefs file on the server with this script file.  This script will look in its own folder, in the cgi-bin folder, and in the login folder by default.  You can also add a new line to this script's prefs file setting \$PREF{userbase_prefs_file_extra} to the full filename (including path) of your UserBase prefs file.") unless $prefs_loaded;
	}
	
	$PREF{loaded_userbase_prefs_files} =~ s!, $!!;

	$PREF{custom_field_list_table} = $PREF{custom_field_table} if $PREF{custom_field_table} && !$PREF{custom_field_list_table}; # For backwards compatibility;
	$PREF{custom_field_table} = $PREF{custom_field_list_table} if $PREF{custom_field_list_table} && !$PREF{custom_field_table}; # this was just a renamed pref.
}


sub get_likely_prefs_file_locations($)
{
	my $prefs_file = shift;
	my ($script_dirname) = ($ENV{SCRIPT_NAME} =~ m!^(.+)/.*?$!);
	return($prefs_file,
		"$PREF{DOCROOT}/cgi-bin/$prefs_file",		"$PREF{DOCROOT}/../cgi-bin/$prefs_file",
		"$PREF{DOCROOT}/cgi/$prefs_file",		"$PREF{DOCROOT}/../cgi/$prefs_file",
		"$PREF{DOCROOT}/login/$prefs_file",		"$PREF{DOCROOT}/../login/$prefs_file",
		"$PREF{DOCROOT}$script_dirname/$prefs_file",	"$PREF{DOCROOT}/..$script_dirname/$prefs_file"
	);
}


sub load_other_prefs_files
{
	my @other_prefs_files = ();
	foreach my $num (sort keys %{$PREF{other_prefs_files}})
	{
		my $name = $PREF{other_prefs_files}{$num}{shortcut_name};
		if($qs =~ /(?:^|&)prefs=$name(?:&|$)/)
		{
			my $file = $PREF{other_prefs_files}{$num}{shortcut_target};
			if($PREF{other_prefs_files_are_in_docroot} =~ /yes/i)
			{
				$file = "$PREF{DOCROOT}/$file";
				condense_slashes('leave_leading_UNC', $file);
			}
			die_nice("prefs file '$file' does not exist.") unless -e $file;
			push @other_prefs_files, $file;
		}
	}
	if($PREF{enable_other_prefs_files_with_filename_on_URL} =~ /yes/i)
	{
		while($qs =~ /(?:^|&)prefsfile=(.+?)(?:&|$)/g)
		{
			my $file = $1;
			if($PREF{other_prefs_filenames_from_URL_can_contain_paths} =~ /yes/i)	{ $file = enc_untaint($file, 'keep_path');	}
			else									{ $file = enc_untaint($file);			}
			if($PREF{other_prefs_files_are_in_docroot} =~ /yes/i)
			{
				$file = "$PREF{DOCROOT}/$file";
				condense_slashes('leave_leading_UNC', $file);
			}
			die_nice("prefs file '$file' does not exist.") unless -e $file;
			push @other_prefs_files, $file;
		}
	}
	foreach my $prefs_file (@other_prefs_files)
	{
		my $prefs_contents = ();
		open(IN,"<$prefs_file") or die_nice("couldn't open prefs file '$prefs_file': $!");
		flock IN, 1;
		seek IN, 0, 0;
		while(<IN>) { $prefs_contents .= $_; }
		close IN or die_nice("couldn't close prefs file '$prefs_file': $!");
		$prefs_contents =~ /(.*)/s;
		$prefs_contents = $1; # cheap untaint since this is our own config file.
		eval $prefs_contents; die_nice("Error processing your prefs file: $@") if $@;
	}
}


sub do_preinit()
{
	$PREF{app_start_time} = time;
	if($ENV{QUERY_STRING} eq 'version') { print "Content-type: text/plain\n\n"; print "$version\n"; exit; }
	my ($cwd) = ($ENV{SCRIPT_FILENAME} =~ m!^(.+)/.*?$!);
	unless($cwd) { $cwd = $ENV{PATH_TRANSLATED}; $cwd =~ s![^/\\]+$!!; }
	enc_chdir($cwd);
	$PREF{initial_cwd} = $cwd;
	$PREF{on_page} = 'default';
	$qs = $ENV{QUERY_STRING};
	$PREF{we_are_embedded} = $qs =~ /encembed=yes/ ? 1 : 0; $qs =~ s!&encembed=yes!!g; $qs =~ s!encembed=yes&!!g; $qs =~ s!encembed=yes!!g;   # remove it so it's not present on any URLs where we re-use $qs, because this should only be present when hard-coded from a php/shtml/etc page.
	populate_cookies_hash();
}


sub verify_server_environment()
{
	#print STDERR dumphash(\%ENV,"\n") . "\n";
	my ($SCRIPT_var_count, $SERVER_var_count) = (0, 0);
	my @all_vars = ();
	foreach my $var (sort keys %ENV)
	{
		$SCRIPT_var_count++ if $var =~ /^SCRIPT_/;
		$SERVER_var_count++ if $var =~ /^SERVER_/;
		push @all_vars, "$var: $ENV{$var}";
	}
	unless($SCRIPT_var_count > 0 && $SERVER_var_count > 0)
	{
		die qq`Error: it seems I've been executed on a command line, but that won't work, since I'm a web application and must be executed within a server environment.\n`; # . qq`\nAll vars: ` . (join "\n", @all_vars) . qq`\n\n`;
	}
}


sub fix_server_environment()
{
	# Fix the %ENV if necessary.
	#
	if(!$ENV{REQUEST_URI}) # IIS is crap.
	{
		$ENV{REQUEST_URI} = $ENV{PATH_INFO};
		$ENV{REQUEST_URI} .= '?' . $qs if $qs;
	}

	# On GoDaddy, for subdomains, they set DOCUMENT_ROOT incorrectly, and set SUBDOMAIN_DOCUMENT_ROOT to the real docroot.
	$ENV{DOCUMENT_ROOT} = $ENV{SUBDOMAIN_DOCUMENT_ROOT} if $ENV{SUBDOMAIN_DOCUMENT_ROOT};

	$PREF{DOCROOT} ||= $ENV{DOCUMENT_ROOT};
	if(!$PREF{DOCROOT})
	{
		($PREF{DOCROOT}) = ($ENV{SCRIPT_FILENAME} =~ m!^(.+)$ENV{SCRIPT_NAME}$!i);
		if(!$PREF{DOCROOT})
		{
			# try to fix IIS garbage.
			my $path_translated = $ENV{PATH_TRANSLATED};
			my $is_unc = $path_translated =~ m!^\\\\!;
			$path_translated =~ s!\\\\!/!g;
			$path_translated =~ s!\\!/!g;
			$path_translated =~ s!^[/\\]+!\\\\! if $is_unc;
			if($path_translated =~ m!^(.+)$ENV{PATH_INFO}$!i)
			{
				$PREF{DOCROOT} = $1;
			}
			else
			{
				$PREF{DOCROOT} = ($path_translated =~ m!(.+)/[^/]+!)[0];
			}
		}
		$PREF{docroot_autodetection_error} = "Error: couldn't set \$PREF{DOCROOT} from \$ENV{DOCUMENT_ROOT} ('$ENV{DOCUMENT_ROOT}'), \$ENV{SCRIPT_FILENAME} ('$ENV{SCRIPT_FILENAME}'), or \$ENV{PATH_TRANSLATED} ('$ENV{PATH_TRANSLATED}').\n" unless $PREF{DOCROOT};
	}
	$PREF{DOCROOT} =~ s![/\\]+$!! unless $PREF{DOCROOT} =~ m!^[/\\]+$!; # remove trailing slashes.

	# Fix another Network Solutions bug:
	if($PREF{DOCROOT} =~ m!/usr/services/vux/apache/htdocs!   &&   $ENV{SCRIPT_FILENAME} =~ m!(/data/\d+/\d+/\d+/\d+/\d+/user/\d+)/cgi-bin!)
	{
		$PREF{DOCROOT} = "$1/htdocs";
	}

	my $default_scriptname = '/cgi-bin/' . $PREF{internal_filename} . '.cgi';
	$ENV{SCRIPT_NAME} ||= $default_scriptname;

	# Fix for broken Network Solutions servers:
	$ENV{SCRIPT_NAME} = $1 if $ENV{SCRIPT_NAME} =~ m!~\d+\.\d+/(/cgi-bin/.+)!;

	# Fix stupid servers that set our scriptname to the wrapper scriptname:
	$ENV{SCRIPT_NAME} = $default_scriptname if $ENV{SCRIPT_NAME} =~ /\.php/ && -e "$PREF{DOCROOT}/$default_scriptname";
	$ENV{SCRIPT_NAME} = $default_scriptname if $ENV{SCRIPT_NAME} =~ /\.php/ && -e "$PREF{DOCROOT}/../$default_scriptname";
}


sub set_default_prefs_for_all_apps()
{
	# Prefs that are needed by all apps, and that are (at least by default) set
	# to the same values in all apps.  And we don't need any "unless exists"
	# tests here because this sub is called before loading external prefs.

	$PREF{list_of_sql_safe_characters} = qq`ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz 0123456789 !#%^&*()_=+ ~ []{}| ;:'" ,.<>/? \`\@\$\r\n\t\\-`; # dash, if present, must be last.

	$PREF{max_tablename_length}			= 80;

	$PREF{site_session_cookie}			= 'site_session';
	$PREF{non_userbase_login_cookie}		= 'enc_non_ub_login';
	$PREF{num_days_login_lasts}			= 14;
	$PREF{enc_visitor_id_cookie}			= 'encvisid';
	$PREF{enc_visitor_id_was_missing}		= 1 unless $COOKIE{ $PREF{enc_visitor_id_cookie} };
	$PREF{enc_visitor_id}				= $COOKIE{ $PREF{enc_visitor_id_cookie} } || generate_random_hash();

	$PREF{public_group_name}			= 'public';
	$PREF{member_group_name}			= 'member';
	$PREF{admin_group_name}				= 'admin';

	$PREF{writable_dir_perms}			= 0777;
	$PREF{writable_file_perms}			= 0666;

	$PREF{here}					= $ENV{SCRIPT_NAME};
	#$PREF{here_login}				= $ENV{SCRIPT_NAME}; # deprecated by figure_out_where_here_is (?)

	$PREF{needlogin_message}			= qq`%%js_auto_redirect%%<h1 class="pagetitle">Login Required</h1><p>Login required; <a href="%%login_url%%">click here</a> to continue.</p>`;
	$PREF{needprivs_message}			= qq`%%js_auto_redirect%%<h1 class="pagetitle">Access Denied</h1><p>Access denied.&nbsp; %%%if-notloggedin%%%Perhaps you need to <a href="%%login_url%%">login</a> first?%%%end-notloggedin%%%</p>`;
}


sub check_for_enc_visitor_id()
{
	# This check must occur before trying anything that could result in an error
	# like reading prefs files, checking whether datadirs exist, etc.  That's 
	# because in some cases, particularly when a client wants to use ENV variables
	# from PHP to set a path pref dynamically, an error due to a nonexistent path
	# would prevent us from setting the enc_visitor_id, but would also be *caused*
	# by a missing enc_visitor_id.  So, set_enc_visitor_id() is designed to not
	# depend on anything else (prefs, etc), so it can be called separately and
	# then exit, just to get the cookie in place.

	if($qs =~ /(^|&)action=set_enc_visitor_id(&|$)/) { set_enc_visitor_id(); } # exits early.
}


sub load_webconfig_prefs
{

}


sub populate_cookies_hash()
{
	foreach my $cookie (split(/;\s*/, $ENV{HTTP_COOKIE}))
	{
		my ($name,$value) = split(/=/, $cookie);
		$COOKIE{$name} = enc_urldecode_return($value);
	}
}


sub settle_docroot_datadir_cgimodule_etc()
{
	# DOCROOT must be one of the first things settled after loading the external prefs:
	#
	$PREF{DOCROOT} = enc_untaint($PREF{DOCROOT}, 'keep_path');
	exit_with_error("Error: you have set \$PREF{DOCROOT} to '$PREF{DOCROOT}', but that path does not exist.  You must create it now, or adjust this setting to point to the correct directory.") if ! -d $PREF{DOCROOT};


	# datadir should be settled right after DOCROOT:
	#
	$PREF{datadir} = 'encdata' unless $PREF{datadir};
	$PREF{datadir} = $PREF{DOCROOT} . $PREF{datadir} if $PREF{datadir_is_in_docroot} eq 'yes';
	create_dir_if_DNE($PREF{datadir}, $PREF{writable_dir_perms}, 'make_parents', 'ignore_errors');
	exit_with_error(qq`Error: your settings for \$PREF{datadir} and \$PREF{datadir_is_in_docroot} \nresult in \$PREF{datadir} being set to '$PREF{datadir}', \nbut that path does not exist.  You must create it, or adjust these \nsettings to point to the correct directory.`) unless -d $PREF{datadir};
	exit_with_error(qq`Error: the directory \$PREF{datadir}  ($PREF{datadir})  must be readable by this script (which usually means world-readable), but it isn't.`) if ! -r $PREF{datadir};
	exit_with_error(qq`Error: the directory \$PREF{datadir}  ($PREF{datadir})  must be writable by this script (which usually means world-writable), but it isn't.`) if ! -w $PREF{datadir};
	#
	# Append our per-app subdir onto datadir ($PREF{datadir} should be set to just 'encdata' by default):
	#
	$PREF{datadir_subdir_name} = $PREF{internal_appname} unless $PREF{datadir_subdir_name};
	$PREF{datadir} .= $PREF{datadir} =~ m![/\\]$! ? $PREF{datadir_subdir_name} : "/$PREF{datadir_subdir_name}";
	create_dir_if_DNE($PREF{datadir}, $PREF{writable_dir_perms});


	if($PREF{debuglog} =~ /yes/i)
	{
		$PREF{debuglogdir} = $PREF{datadir} . '/debuglogs';
		create_dir_if_DNE($PREF{debuglogdir}, $PREF{writable_dir_perms});
		$PREF{debuglogfile} = $PREF{debuglogdir} . '/' . date8() . '.cgi';
		create_file_if_DNE($PREF{debuglogfile}, $PREF{writable_file_perms});
	}


	# Once $PREF{datadir} is settled, set $ENV{TMPDIR} to that, and THEN we can
	# import the CGI module via "require CGI;" and it will use our $ENV{TMPDIR}
	# setting as its temp space during uploads.
	#
	$ENV{TMPDIR} = $PREF{datadir} unless $PREF{dont_use_datadir_as_cgi_tmpdir} =~ /yes/i;
	$CGITempFile::TMPDIRECTORY = $PREF{datadir} unless $PREF{dont_use_datadir_as_cgi_tmpdir} =~ /yes/i; # necessary on some servers?
	#
	#use CGI; # DO NOT USE THIS!
	#
	require CGI;
	#
	#use CGI qw/:standard :param/; # DO NOT USE THIS!
	#use CGI qw(param); # DO NOT USE THIS!
	#
	import CGI ':standard';
	import CGI ':param';
	#
	use CGI::Cookie; # "use" is OK for sub-modules.


	unless($PREF{app_base_folder} =~ m!^/!)
	{
		$PREF{app_base_folder} = '/login'	if $PREF{internal_appname} eq 'userbase';
		$PREF{app_base_folder} = '/upload'	if $PREF{internal_appname} eq 'filechucker';
		$PREF{app_base_folder} = '/visitors'	if $PREF{internal_appname} eq 'visitorlog';
		$PREF{app_base_folder} = '/contact'	if $PREF{internal_appname} eq 'contactform';
		$PREF{app_base_folder} = '/mailylist'	if $PREF{internal_appname} eq 'mailylist';
		$PREF{app_base_folder} = '/store'	if $PREF{internal_appname} eq 'cornerstore';
	}
	exit_with_error("Error: \$PREF{app_base_folder} not set; it must be set to something like '/appname'.") unless $PREF{app_base_folder};


	# appdir is like datadir except a) it's servable and b) it's per-app (within the
	# app's base folder) rather than within the shared /cgi-bin/encdata folder.
	#
	$PREF{appdir_url}	= $PREF{app_base_folder} . ($PREF{app_base_folder} =~ m![/\\]$! ? '' : '/') . "appdata";
	$PREF{appdir_real}	= $PREF{DOCROOT} . $PREF{appdir_url};
	exit_with_error("$PREF{internal_appname_nice}'s appdata folder ('$PREF{appdir_url}') does not exist on your website; you must create it now, or else adjust the \$PREF{app_base_folder} setting.  This must be within your \$PREF{DOCROOT}, which is currently '$PREF{DOCROOT}'.") unless -d $PREF{appdir_real};

	unless($PREF{skip_appdir_permissions_checks} =~ /yes/i)
	{
		my @all_dirs = ($PREF{appdir_real}, $PREF{datadir});
		push (@all_dirs, $PREF{appdir_real} . '/' . $_) for get_all_subdirs($PREF{appdir_real});
		push (@all_dirs, $PREF{datadir} . '/' . $_) for get_all_subdirs($PREF{datadir});
		foreach my $dir (@all_dirs)
		{
			exit_with_error("The '$dir' folder must be readable by this script (which usually means world-readable), but it isn't; you must adjust its permissions to make it so.") unless -r $dir;
			exit_with_error("The '$dir' folder must be writable by this script (which usually means world-writable), but it isn't; you must adjust its permissions to make it so.") unless -w $dir;
		}
	}
}


sub figure_out_where_here_is
{
	$PREF{here} ||= $ENV{SCRIPT_NAME};
	$PREF{here} = ($ENV{REQUEST_URI} =~ m!([^\?]+)!)[0] if $ENV{REQUEST_URI} && $PREF{here} eq 'auto';
	for('here_static', 'here_login')
	{
		$PREF{$_} = $PREF{here} unless $PREF{$_}; # ($PREF{$_} && $PREF{$_} ne $ENV{SCRIPT_NAME});
		$PREF{$_} = $ENV{SCRIPT_NAME} unless $PREF{$_} =~ /./;

		$PREF{$_ . '_qsready'} = $PREF{$_} =~ /\?/ ? "$PREF{$_}&amp;" : "$PREF{$_}?";
	}
	$PREF{here_qsready} = $PREF{here} =~ /\?/ ? "$PREF{here}&amp;" : "$PREF{here}?";
	$PREF{login_url_qsready} = $PREF{login_url} =~ /\?/ ? "$PREF{login_url}&amp;" : "$PREF{login_url}?";
}


sub do_postpref_processing()
{
	# Use this spot for any code that must run immediately after prefs are loaded.
	#
	if($PREF{internal_appname} eq 'visitorlog')
	{
		$PREF{print_full_html_tags} = 'no' if $qs =~ /(^|&)(justsummary|mode=hitsgraph)(&|$)/;
	}

	# These are postpref so they can use offsettime():
	#
	my $start	= offsettime();
	$PREF{date8}	= date8($start);
	$PREF{date14}	= date14($start);
}


sub do_blacklisting_and_whitelisting()
{
	do_group_based_blacklisting_and_whitelisting();

	my $blocked = 0;

	my $ip_whitelisting_enabled = 0;
	my $user_matches_ip_whitelist = 0;
	foreach my $rule (sort keys %{$PREF{forced_whitelist_ip_addresses}})
	{
		if(my $allowed_ip = $PREF{forced_whitelist_ip_addresses}{$rule})
		{
			$ip_whitelisting_enabled = 1;
			$user_matches_ip_whitelist = 1 if $PREF{ip} =~ /$allowed_ip/;
		}
	}
	$blocked = 1 if $ip_whitelisting_enabled && !$user_matches_ip_whitelist;

	my $host_whitelisting_enabled = 0;
	my $user_matches_host_whitelist = 0;
	foreach my $rule (sort keys %{$PREF{forced_whitelist_hostnames}})
	{
		if(my $allowed_host = $PREF{forced_whitelist_hostnames}{$rule})
		{
			$host_whitelisting_enabled = 1;
			$user_matches_host_whitelist = 1 if $PREF{host} =~ /$allowed_host/i;
		}
	}
	$blocked = 1 if $host_whitelisting_enabled && !$user_matches_host_whitelist;

	foreach my $rule (sort keys %{$PREF{forced_blacklist_ip_addresses}})
	{
		if(my $blocked_ip = $PREF{forced_blacklist_ip_addresses}{$rule})
		{
			$blocked = 1 if $PREF{ip} =~ /$blocked_ip/;
		}
	}

	foreach my $rule (sort keys %{$PREF{forced_blacklist_hostnames}})
	{
		if(my $blocked_host = $PREF{forced_blacklist_hostnames}{$rule})
		{
			$blocked = 1 if $PREF{host} =~ /$blocked_host/;
		}
	}

	exit_with_error($TEXT{failed_black_or_white_list}) if $blocked;
}


sub do_group_based_blacklisting_and_whitelisting()
{
	foreach my $rule (sort keys %{$PREF{grouped_whitelist_ip_addresses}})
	{
		if(my $allowed_ip = $PREF{grouped_whitelist_ip_addresses}{$rule})
		{
			$PREF{user_is_encwhitelisted} = 1 if $PREF{ip} =~ /$allowed_ip/;
		}
	}

	foreach my $rule (sort keys %{$PREF{grouped_whitelist_hostnames}})
	{
		if(my $allowed_host = $PREF{grouped_whitelist_hostnames}{$rule})
		{
			$PREF{user_is_encwhitelisted} = 1 if $PREF{host} =~ /$allowed_host/i;
		}
	}

	foreach my $rule (sort keys %{$PREF{grouped_blacklist_ip_addresses}})
	{
		if(my $blocked_ip = $PREF{grouped_blacklist_ip_addresses}{$rule})
		{
			$PREF{user_is_encblacklisted} = 1 if $PREF{ip} =~ /$blocked_ip/;
		}
	}

	foreach my $rule (sort keys %{$PREF{grouped_blacklist_hostnames}})
	{
		if(my $blocked_host = $PREF{grouped_blacklist_hostnames}{$rule})
		{
			$PREF{user_is_encblacklisted} = 1 if $PREF{host} =~ /$blocked_host/;
		}
	}
}


sub get_cookies()
{
	my %cookies = fetch CGI::Cookie;
	return %cookies;
}


sub get_cookie($)
{
	my $which = shift;
	my %jar = get_cookies();
	my $value = '';

	if(exists $jar{$which})
	{
		$value = $jar{$which}->value;
	}
	elsif($which eq $PREF{site_session_cookie})
	{
		if($qs =~ /(?:^|&)ubsessioncode=(\w+)(?:&|$)/)
		{
			my $code = $1;

			# Accepting the session code from the URL should only be allowed as a last resort.
			# On decent servers this shouldn't be necessary because we can call UserBase
			# from PHP using virtual() and/or exec() both of which pass the cookies.  Even
			# on sub-par servers where we have to use include() with the full http:// URL,
			# we can reduce the security risk by requiring the remote IP to match the server
			# IP, i.e. ONLY allow the include(http://...) method to work: don't accept URL-
			# based session codes from any other IP.  As a last resort on totally sucky
			# servers where PHP is crippled and $ENV{SERVER_ADDR} DNE or is variable or
			# otherwise useless, proceed only by setting a PREF that indicates what a bad
			# idea it is.

			if($PREF{ip} eq $ENV{SERVER_ADDR})
			{
				$value = $code;
			}
			elsif($PREF{my_server_sucks_so_use_less_secure_mode} =~ /yes/i)
			{
				sleep $PREF{sleeptime_for_less_secure_mode} || 3;
				$value = $code;
			}
		}
	}

	return $value;
}


sub set_cookie($$$)
{
	my $name = shift;
	my $value = shift;
	my $expiry = shift;
	my $cookie = undef;

	# The if/else for expiry is because setting "expires" to "" isn't
	# the same as not setting it.  Setting it to "" is the same as 
	# setting it to zero, which expires the cookie immediately
	# (i.e., deletes it).  But explicitly *not* setting the expiry
	# causes the cookie to persist until the end of the session.

	if($PREF{cookie_domain})
	{
		if($expiry eq "")	{ $cookie = new CGI::Cookie(-name => $name, -value => $value, -path => '/', -domain => $PREF{cookie_domain});				}
		else			{ $cookie = new CGI::Cookie(-name => $name, -value => $value, -path => '/', -domain => $PREF{cookie_domain}, -expires => $expiry);	}
	}
	else
	{
		if($expiry eq "")	{ $cookie = new CGI::Cookie(-name => $name, -value => $value, -path => '/');						}
		else			{ $cookie = new CGI::Cookie(-name => $name, -value => $value, -path => '/', -expires => $expiry);			}
	}

	if($PREF{output_started})
	{
		print "<p>$PREF{internal_appname} warning: cannot set cookie '$name' => '$value' because the page output has already been started (perhaps debug is enabled?).</p>\n";
	}
	elsif($PREF{we_are_virtual})
	{
		print_http_headers();
		print "<p>$PREF{internal_appname} warning: cannot set cookie '$name' => '$value' because we are virtual.</p>\n";
	}
	else
	{
		print_p3p_header();
		print "Set-Cookie: $cookie\n";
	}
}


sub determine_cookie_domain
{
	if($ENV{HTTP_HOST} =~ /\w+\.\w+/   &&   !is_ipv4_address($ENV{HTTP_HOST})   &&   !($PREF{never_specify_domain_when_setting_cookies} =~ /yes/i))
	{
		# If we're running on a domain name, then specify it in our cookies.  This allows us
		# to put a dot at the start of the domain name, which causes the cookies to be set for
		# and accessible from the domain and all subdomains including www.  So we'll remove
		# any leading www first, as well as any port number.

		my $domain = $ENV{HTTP_HOST}; $domain =~ s!^www\.!!; $domain =~ s!:\d+$!!; $domain = ".$domain";
		$PREF{cookie_domain} = $domain;
	}
}


sub get_qs_var
{
	return enc_urldecode_return(   ($qs =~ /(?:^|&(?:amp;)?)$_[0]=([^&]*)/)[0]   );
}


# APICHANGE: 201012: expand_custom_vars_in_prefs() no longer accepts a hashref,
# only an optional string.
#
sub expand_custom_vars_in_prefs
{
	expand_custom_vars_in_prefs___inner(\%PREF, @_);
	expand_custom_vars_in_prefs___inner(\%TEXT, @_);
}


sub expand_custom_vars_in_prefs___inner
{
	my $hashref = shift;
	my $include_undefined = shift; $include_undefined = 0 unless $include_undefined eq 'include_undefined';

	# Execute this a few times without undefineds first, so that nested values can be
	# properly expanded (i.e. one setting contains %PREF{foo}, but $PREF{foo} itself
	# contains %PREF{bar}, etc).

	my $num_iterations = 5;
	for(my $i = 1; $i <= $num_iterations; $i++)
	{
		my $include_undefined_real = $include_undefined && $i == $num_iterations ? 1 : 0;

		foreach my $key (keys %$hashref)
		{
			if(ref($$hashref{$key}) eq 'HASH') # for prefs that are themselves hashes, i.e. $PREF{foo}{01} as in $PREF{foo}{01}{bar}.
			{
				expand_custom_vars_in_prefs___inner($$hashref{$key});
			}
			else
			{
				# from now on, use %%varname%% instead of $$varname$$, so that it doesn't
				# matter whether it gets put in double-quotes.

				next unless $$hashref{$key} && $$hashref{$key} =~ /(\$\$|%%|%PREF{|%TEXT{|%URL{|%COOKIE{|%SQL{|%ENV{|%DATE{)/;
				next if $PREF{"${key}___skip_init_var_expansion"} =~ /yes/i;

				# old way:
				$$hashref{$key} =~ s/\$\$server_name\$\$/$ENV{'SERVER_NAME'}/g;
				$$hashref{$key} =~ s/\$\$httphost_withport\$\$/$ENV{'HTTP_HOST'}/g;
				$$hashref{$key} =~ s/\$\$name_of_site\$\$/$$hashref{'name_of_site'}/g;

				# new way:
				$$hashref{$key} =~ s/%%server_name%%/$ENV{SERVER_NAME}/g;
				$$hashref{$key} =~ s/%%http_host%%/$ENV{HTTP_HOST}/g;
				$$hashref{$key} =~ s/%%name_of_site%%/$$hashref{name_of_site}/g;

				#interpolate_vars_from_URL_and_cookies($include_undefined, $$hashref{$key});
				do_standard_template_vars_processing($include_undefined, $$hashref{$key});
			}
		}
	}
}


sub show_prefs
{
	exit_with_needprivs() unless user_is_allowed_to('view_administration_page');
	$PREF{on_a_wide_page} = 1;
	start_html_output("Prefs");
	print qq`<div id="enc_prefs_list" class="enc_tbl">\n<table>\n<tr><th>Prefs</th></tr>\n`;
	my $oddeven = 1;
	my $allprefs = get_prefs('all');
	foreach my $pref (sort { lc($a) cmp lc($b) } keys %$allprefs)
	{
		print qq`<tr class="` . oddeven($oddeven) . qq`"><td><strong>$pref:</strong> $$allprefs{$pref}</td></tr>\n`;
	}
	print qq`</table>\n</div>\n`;
	finish_html_output();
}


sub get_prefs
{
	my $all = shift;
	my %prefs = ();
	foreach my $key (sort { lc($a) cmp lc($b) } keys %PREF)
	{
		#if($all   ||   ($key !~ /^(database_name|database_hostname|database_username|database_password|smtp_auth_username|smtp_auth_password)$/))
		#
		# It's not necessary to hide those sensitive values, since we're only
		# displaying all prefs in authenticated situations in the first place.
		#
		if(1)
		{
			my $value = $PREF{$key};
			$value =~ s!<!&lt;!g;
			$value =~ s!>!&gt;!g;
			$value =~ s!\n!\n<br />!g;
			$prefs{$key} = $value;
		}
	}
	return \%prefs;
}


sub show_server_info
{
	exit_with_needprivs() unless user_is_allowed_to('view_administration_page');

	start_html_output($TEXT{Server_Information});

	eval { require MIME::Lite; }; my $mimeliteversion = $@ ? qq`not installed` : $MIME::Lite::VERSION;

	my $old_cgi_text = $PREF{internal_appname} =~ /filechucker/i ? 'uploads' : 'some features';

	print	  qq`
		<div id="enc_server_info" class="enc_tbl">
		<table>
		<tr><th colspan="2">Server Information</th></tr>
		<tr><td>\$CGI::VERSION</td>		<td>$CGI::VERSION (if v3.02 or older, $old_cgi_text probably won't work, at least not reliably)</td></tr>
		<tr><td>\$] (Perl version)</td>		<td>$]</td></tr>
		<tr><td>\$MIME::Lite::VERSION</td>	<td>$mimeliteversion</td></tr>
		<tr><td>\$PREF{DOCROOT}</td>		<td>$PREF{DOCROOT}</td></tr>
		<tr><td colspan="2">Environment variables:</td></tr>
	`;

	foreach my $var (sort keys %ENV)
	{
		$ENV{$var} =~ s!<!&lt;!g;
		$ENV{$var} =~ s!>!&gt;!g;
		print qq`<tr><td>$var</td>	<td>$ENV{$var}</td></tr>\n`;
	}

	print	  qq`</table>\n</div>\n`;

	finish_html_output();
}


sub store_keyed_message
{
	my $new_message = shift;
	$new_message =~ s/\n/::ENCNL::/gs;

	my $one_day = 60*60*24*1;
	my $one_week = 60*60*24*7;
	my $current_time = offsettime();
	$PREF{max_age_for_keyed_messages} = $one_day unless $PREF{max_age_for_keyed_messages} =~ /^\d+/;

	my $key = md5_hex($new_message . $current_time . $$ . $ENV{REMOTE_PORT} . $PREF{ip} . $ENV{HTTP_USER_AGENT});
	my $uid = $PREF{logged_in_userid} =~ /^-?\d+$/ ? $PREF{logged_in_userid} : 0;

	my $mfile = add_initial_cwd_prefix($PREF{datadir} . '/' . "_$PREF{internal_appname}_keyed_messages.cgi");
	create_file_if_DNE($mfile,$PREF{writable_file_perms});
	# Note: this -w test must use die rather than die_nice, because in situations such as POSTs where store_keyed_message is used, die_nice would just call store_keyed_message again, resulting in an infinite loop.
	die qq`Error: our keyed-message file ('$mfile') is not writable; you must either make it so, or else delete it so we can re-create it with the correct permissions.` unless -w $mfile;
	my @messages = ();
	open(MFILE,"+<$mfile") or die_nice("could not open file '$mfile' for R/W: $!\n");
	flock MFILE, 2;
	seek MFILE, 0, 0;
	while(<MFILE>)
	{
		if(/^(\d+):/)
		{
			my ($time) = ($1);
			push (@messages,$_) if($time > ($current_time - $PREF{max_age_for_keyed_messages}));
		}
		elsif(/^[\s\n]*$/)
		{
			push (@messages, $_);
		}
	}
	seek MFILE, 0, 0;
	print MFILE @messages;
	print MFILE "${current_time}:${key}:${uid}:$PREF{ip}:$new_message\n\n\n"; # 3 newlines so the raw log is somewhat readable.
	truncate MFILE, tell MFILE;
	close MFILE or die_nice("could not close file '$mfile' after R/W: $!\n");

	return $key;
}


sub get_keyed_message
{
	my $key = shift;
	my $message = '';

	my $mfile = add_initial_cwd_prefix($PREF{datadir} . '/' . "_$PREF{internal_appname}_keyed_messages.cgi");
	create_file_if_DNE($mfile,$PREF{writable_file_perms});
	open(MFILE,"<$mfile") or die_nice("could not open file '$mfile' for reading: $!\n");
	flock MFILE, 1;
	seek MFILE, 0, 0;
	while(<MFILE>)
	{
		if(/^\d+:${key}:(-?\d+):([\d\.]+):(.*)/)
		{
			my ($uid_on_message,$ip_on_message,$msg) = ($1,$2,$3);
			if($PREF{admin_is_logged_in})
			{
				$message = $msg;
			}
			elsif($PREF{member_is_logged_in} && $PREF{logged_in_userid} eq $uid_on_message)
			{
				$message = $msg;
			}
			elsif($PREF{ip} eq $ip_on_message   &&   $uid_on_message =~ /^(0|-1)$/) # only allow IP-based auth if the owner is public.
			{
				$message = $msg;
			}
			else
			{
				$message = qq`Error: access denied based on userid and/or IP address.`;
			}
			last;
		}
	}
	close MFILE or die_nice("could not close file '$mfile' after reading: $!\n");

	$message =~ s/::ENCNL::/\n/gs;
	return $message || qq`Message expired.`;
}


# Never call chdir directly; always call enc_chdir instead:
sub enc_chdir($)
{
	my $dir = shift;
	$PREF{new_cwd} = $dir;
	chdir $dir or die_nice qq`Couldn't chdir to directory "$dir": $!\n`;
}


# This is necessary for cases where we've chdir()ed somewhere other than the
# $PREF{initial_cwd}, after which we want to use $PREF{datadir}, which by
# default is not in DOCROOT and contains no path -- it's relative to the
# initial working directory.
#
sub add_initial_cwd_prefix($)
{
	my $item = shift;
	if($PREF{new_cwd} ne $PREF{initial_cwd})
	{
		$item = $PREF{initial_cwd} . '/' . $item;
		condense_slashes('leave_leading_UNC', $item);
	}
	# return the input unchanged if we're still in the initial_cwd.
	return $item;
}


# pass filename to create and optionally the mode to chmod it to.
# the mode must consist of 1-4 octal digits and must NOT be quoted.
# see "perldoc -f chmod" and "man chmod".
sub create_file_if_DNE
{
	my $file = shift;
	my $mode = shift;

	return if -T $file;
	open(NEW,">$file") or die "$0: couldn't create new file $file: $!\n";
	close NEW or die "$0: couldn't close $file after creating it: $!\n";
	if($mode)
	{
		chmod($mode,$file) or die "$0: couldn't chmod file \"$file\" with mode \"$mode\": $!\n";
	}
}


sub create_dir_if_DNE
{
	my $dir = shift;
	my $mode = shift;
	my $make_parents_if_necessary = shift; $make_parents_if_necessary = $make_parents_if_necessary eq 'make_parents';
	my $ignore_errors = shift; $ignore_errors = $ignore_errors eq 'ignore_errors';

	return if -d $dir;

	$dir =~ s!\\!/!g;
	if($make_parents_if_necessary)
	{
		my $progressively_longer_path = '';
		my $i = 0;
		foreach my $individual_path_element(split(/\//, $dir))
		{
			$i++;
			if($i == 1)
			{
				if($dir =~ m!^(\w:/)!) # Winders.
				{
					$progressively_longer_path = $1;
					next;
				}
				elsif(!$individual_path_element) # this means $dir starts with a slash.
				{
					$progressively_longer_path = '/';
					next;
				}
			}

			$progressively_longer_path .= $individual_path_element;
			unless(-d $progressively_longer_path)
			{
				mkdir($progressively_longer_path,$PREF{writable_dir_perms}) or $ignore_errors || die_nice("couldn't create path-portion '$progressively_longer_path' as part of dir '$dir': $!");
				if($mode)
				{
					chmod($mode,$progressively_longer_path) or $ignore_errors || die_nice("couldn't chmod path-portion '$progressively_longer_path' as part of dir '$dir' with mode '$mode': $!");
				}
			}
			$progressively_longer_path .= '/';
		}
	}
	else
	{
		mkdir($dir,$PREF{writable_dir_perms}) or $ignore_errors || die_nice("couldn't create dir $dir: $!");
		if($mode)
		{
			chmod($mode,$dir) or $ignore_errors || die_nice("couldn't chmod dir \"$dir\" with mode \"$mode\": $!");
		}
	}

	$ignore_errors || die_nice qq`dir does not exist after creation: '$dir'` unless -d $dir;
}


sub mirror_dir_tree_and_contents($$)
{
	my ($src,$dst) = @_;
	for(@_) { return(0, qq`error: does not exist: '$_'`) unless -e $_; return(0, qq`error: not a directory: '$_'`) unless -d $_; }
	my ($files, $subfolders) = get_items($src);

	my (@successes, @errors) = ();
	# start with the shortest pathname to ensure we create parents first.
	#
	foreach my $srcfolder (sort { length($a) <=> length($b) } @$subfolders)
	{
		my $mode = sprintf "%04o", (   (stat($srcfolder))[2] & 07777   );
		my $dstfolder = $dst . ($srcfolder =~ /^$src(.+)/)[0];
		if(mkdir($dstfolder, oct($mode)))
		{
			if(chmod(oct($mode), $dstfolder))
			{
				push @successes, $dstfolder;
				copy_custom_folder_perms($srcfolder, $dstfolder) if $PREF{internal_appname} eq 'filechucker' && custom_folder_perms_enabled() && $PREF{when_copying_a_folder_also_copy_its_cust_perms} =~ /yes/i;
			}
			else
			{
				push @errors, qq`Couldn't chmod dir '$dstfolder' with mode '$mode': $!`;
			}
		}
		else
		{
			push @errors, qq`Couldn't mkdir '$dstfolder' with mode '$mode': $!`;
		}
	}

	foreach my $srcfile (@$files)
	{
		my $mode = sprintf "%04o", (   (stat($srcfile))[2] & 07777   );
		my $dstfile = $dst . ($srcfile =~ /^$src(.+)/)[0];
		if(copy($srcfile, $dstfile))
		{
			if(chmod(oct($mode), $dstfile))
			{
				push @successes, $dstfile;
			}
			else
			{
				push @errors, qq`Couldn't chmod file '$dstfile' with mode '$mode': $!`;
			}
		}
		else
		{
			push @errors, qq`Couldn't copy source file '$srcfile' to destination file '$dstfile': $!`;
		}
	}
	
	copy_custom_folder_perms($src, $dst) if $PREF{internal_appname} eq 'filechucker' && custom_folder_perms_enabled() && $PREF{when_copying_a_folder_also_copy_its_cust_perms} =~ /yes/i;

	return (\@successes, \@errors);
}


# Note: we use "die" rather than "die_nice" throughout the send_email function,
# because most of the code is within eval{} blocks, so that we can catch the
# dies and then decide at the end what to do with them.
#
sub send_email
{
	my ($to, $from, $subj, $msg, $mimetype, $die_on_error, $attachment_hashref, $dont_fork) = @_;
	$mimetype = $mimetype =~ /html/i ? 'text/html' : 'text/plain';

	encdebuglog "about to send email: from=$from, to=$to, subject=$subj";

	$die_on_error = $die_on_error eq 'die_on_email_error' ? 1 : 0;
	$dont_fork = $dont_fork eq 'dont_fork' ? 1 : 0;
	my $do_fork = !$die_on_error; # if we want to die on error, we can't fork, or the die() will go unreported.
	$do_fork = 0 if $^O =~ /MSWin32/; # Windows' fork-fu is weak.
	$do_fork = 0 if $dont_fork;
	$do_fork = 0 if $PREF{always_use_nonforking_code_when_sending_email} =~ /yes/i;

	my ($mail_sent_successfully, $error_msg) = 0;

        # fork here because sending mail can be slow (and can block) sometimes.
	# Note: if we don't set $do_fork, perl won't even evaluate the &&'s second
	# half, so the fork won't happen, and the else{} will.
	my $forkpid = ();
        if($do_fork   &&   ($forkpid = fork))
        {
                # parent
        }
        else 
        {
                # child

		use POSIX;

		if($do_fork)
		{
			defined $forkpid or die_nice "$PREF{internal_appname}: fork error in send_email(): $@\n";

			POSIX::setsid() unless $^O =~ /MSWin32/;
			close STDOUT;
			close STDIN;
		}

		my @enc_headers = ();
		unless($PREF{include_encodable_email_headers} =~ /no/i)
		{
			my $sentdate = strftime("%a%b%d,%Y,%I:%M%p",localtime(time + $PREF{time_offset}));
			push @enc_headers, qq`X-Originator-IP: $PREF{ip}`;
			push @enc_headers, qq`X-Originator-Host: $PREF{host}`;
			push @enc_headers, qq`X-Originator-UA: $ENV{HTTP_USER_AGENT}`;
			push @enc_headers, qq`X-Encodable-Sitename: $ENV{HTTP_HOST}`;
			push @enc_headers, qq`X-Encodable-Header: website-visitor`;
			push @enc_headers, qq`X-Encodable-Sent: $sentdate`;
		}

		my $msgid = '<' . time . '.' . md5_hex($to . $from . $subj . $msg . $$ . $ENV{REMOTE_PORT}) . '@' . $ENV{HTTP_HOST} . '>';

		my $smtp_error = '';
		if($PREF{smtp_server})
		{
			# Wrap this in an eval{} in case MIME::Lite is missing.
			# Then we can have the option of setting $PREF{'disable_all_email'}
			# so that the site still functions, sans email.
			eval
			{
				require MIME::Lite;

				my $type = ();
				if($mimetype)
				{
					$type = $mimetype;
				}
				else
				{
					#my $type = $attachment_hashref ? 'multipart/mixed' : 'text/plain';
					$type = $attachment_hashref ? 'multipart/mixed' : 'text/plain; charset=ISO-8859-1; format=flowed';
				}

				my $mime_msg = MIME::Lite->new(To => $to, From => $from, Subject => $subj, Type => $type, Data => $msg);
				die "$PREF{internal_appname}: error creating MIME body: $!\n" unless($mime_msg);

				if($PREF{generate_message_id_internally} =~ /yes/i)
				{
					$mime_msg->add('Message-ID' => $msgid);
				}

				for(@enc_headers)
				{
					my ($name, $value) = split(/: /);
					$mime_msg->add($name => $value);
				}

				if($attachment_hashref)
				{
					foreach my $key (keys %$attachment_hashref)
					{
						my $mimetype			= $$attachment_hashref{$key}{mimetype}; # like 'application/x-gzip'
						my $filename			= $$attachment_hashref{$key}{filename};
						my $recommended_filename	= $$attachment_hashref{$key}{recommended_filename};

						$recommended_filename =~ s!^.*(\\|/)!!; # strip off any preceeding path

						# Attach the test file
						$mime_msg->attach(
							Type => $mimetype,
							Path => $filename,
							Filename => $recommended_filename,
							Disposition => 'attachment'
						) or die "$PREF{internal_appname}: error attaching file to email: $!\n";
					}
				}


				$PREF{smtp_server} = enc_untaint($PREF{smtp_server});
				if($PREF{smtp_auth_username} =~ /\S/ && $PREF{smtp_auth_password} =~ /\S/)
				{
					eval { MIME::Lite->send('smtp', $PREF{smtp_server}, Timeout=>30, AuthUser=>$PREF{smtp_auth_username}, AuthPass=>$PREF{smtp_auth_password}); };
				}
				else
				{
					eval { MIME::Lite->send('smtp', $PREF{smtp_server}, Timeout=>30); };
				}
				die "$PREF{internal_appname}: MIME::Lite->send failed: $@\n" if $@;

				eval { $mime_msg->send; };
				if($@)
				{
					die "$PREF{internal_appname}: \$mime_msg->send failed: $@\n";
				}
				else
				{
					$mail_sent_successfully = 1;
				}


				if($attachment_hashref)
				{
					foreach my $key (keys %$attachment_hashref)
					{
						unlink(  $$attachment_hashref{$key}{filename}  )   if   $$attachment_hashref{$key}{'delete-after-sending'} eq 'yes';
					}
				}
			};

			$smtp_error = $@;
		}

		my $sendmail_error = '';
		if($PREF{path_to_sendmail}   &&   !$mail_sent_successfully)
		{
			if($smtp_error) { enc_warn "$PREF{internal_appname}: send_email(): SMTP failed, so falling back to sendmail.  SMTP error was: $smtp_error\n"; }

			eval
			{
				$PREF{path_to_sendmail} = enc_untaint($PREF{path_to_sendmail}, 'keep_path');

				open(SENDMAIL, "|$PREF{path_to_sendmail} -oi -t") or die "$PREF{internal_appname}: Can't fork for sendmail: $!\n";

				if($attachment_hashref)
				{
					print SENDMAIL	  qq`MIME-Version: 1.0`
							. qq`\nFrom: $from`
							. qq`\nTo: $to`
							. qq`\nSubject: $subj`
							. ($PREF{generate_message_id_internally} =~ /yes/i ? "\nMessage-Id: $msgid" : '')
							. (@enc_headers ? "\n" . (join "\n", @enc_headers) : '')
							. qq`\nContent-Type: multipart/mixed; boundary=encindboundarystring`
							. qq`\n`
							. qq`\n--encindboundarystring`
							. qq`\nContent-Type: ` . ($mimetype ? $mimetype : 'text/plain')
							. qq`\n`
							. qq`\n$msg`;

					foreach my $key (keys %$attachment_hashref)
					{
						my $mimetype			= $$attachment_hashref{$key}{mimetype}; # like 'application/x-gzip'
						$mimetype			= 'application/octet-stream' unless $mimetype;
						my $filename			= $$attachment_hashref{$key}{filename};
						my $recommended_filename	= $$attachment_hashref{$key}{recommended_filename};

						$recommended_filename =~ s!^.*(\\|/)!!; # strip off any preceeding path

						my $atch = `uuencode $filename $filename`;	# UUencode it so we can send it as an attachment

						print SENDMAIL	  qq`\n____________________`
								. qq`\nAttachment: $filename:`
								. qq`\n`
								. qq`\n--encindboundarystring`
								. qq`\nContent-Type: $mimetype; name="$filename"`
								. qq`\nContent-Transfer-Encoding: x-uuencode`
								. qq`\nContent-Disposition: attachment; filename="$recommended_filename"`
								. qq`\n`
								. qq`\n$atch`
								. qq`\n`
								. qq`\n--encindboundarystring`;
					}

					print SENDMAIL	  qq`\n--encindboundarystring--\n`
				}
				else # no attachment.
				{
					print SENDMAIL	  qq`From: $from`
							. qq`\nTo: $to`
							. qq`\nSubject: $subj`
							. ($PREF{generate_message_id_internally} =~ /yes/i ? "\nMessage-Id: $msgid" : '')
							. (@enc_headers ? "\n" . (join "\n", @enc_headers) : '')
							. qq`\nContent-Type: $mimetype`
							. qq`\n`
							. qq`\n$msg`;
				}

				close(SENDMAIL) or $PREF{die_on_sendmail_close_error} =~ /yes/i
						? die		"$PREF{internal_appname}: sendmail didn't close nicely: $!\n"
						: enc_warn	"$PREF{internal_appname}: sendmail didn't close nicely: $!\n";
			};

			if($@)	{ $sendmail_error = $@;		}
			else	{ $mail_sent_successfully = 1;	}
		}

		my $blat_error = '';
		if($PREF{path_to_blat}   &&   $PREF{smtp_server}   &&   !$mail_sent_successfully)
		{
			printd "in blat loop...\n";
			if($sendmail_error) { enc_warn "$PREF{internal_appname}: send_email(): sendmail failed, so trying blat.  sendmail error was: $sendmail_error\n"; }

			my $blat_output = '';
			eval
			{
				#$PREF{path_to_blat} = enc_untaint($PREF{path_to_blat}, 'keep_path');

				my $subj_for_blat = $subj;
				my $msg_for_blat = $msg;
				s!"!\\"!gs for ($subj_for_blat, $msg_for_blat);

				my $u	= "-u $PREF{smtp_auth_username}"	if $PREF{smtp_auth_username};
				my $pw	= "-pw $PREF{smtp_auth_password}"	if $PREF{smtp_auth_password};

				my $html = '-html' if $mimetype =~ /html/i;

				my ($debug,$x) = ('','');
				#$debug = "-debug";
				#$x = qq`-x "X-Custom-header: some header value..."`;

				$blat_output = `$PREF{path_to_blat} - -to $to -f $from -subject "$subj_for_blat" -body "$msg_for_blat" -server $PREF{smtp_server} $u $pw $html $debug $x`;

				#encdebug "blat output: $blat_output\n";
			};

			if($@ || !$blat_output)	{ $blat_error = "Blat error: '$@'.  Blat output was: '$blat_output'"; }
			else			{ $mail_sent_successfully = 1; }
		}

		unless($mail_sent_successfully)
		{
			if($smtp_error)		{ $error_msg .= "$PREF{internal_appname}: couldn't send email: error in send_email() while trying to use MIME::Lite with SMTP server '$PREF{smtp_server}'. Error was: '$smtp_error' <br /><br />\n\n"; }
			if($sendmail_error)	{ $error_msg .= "$PREF{internal_appname}: couldn't send email: error in send_email() while trying to use sendmail with path '$PREF{path_to_sendmail}'. Error was: '$sendmail_error' <br /><br />\n\n"; }
			if($blat_error)		{ $error_msg .= "$PREF{internal_appname}: couldn't send email: error in send_email() while trying to use blat with path '$PREF{path_to_blat}'. Error was: '$blat_error' <br /><br />\n\n"; }

			if(!$error_msg)		{ $error_msg .= "$PREF{internal_appname}: couldn't send email: error in send_email(): perhaps you need to adjust \$PREF{smtp_server} (currently '$PREF{smtp_server}') or \$PREF{path_to_sendmail} (currently '$PREF{path_to_sendmail}'). <br /><br />\n\n"; }

			$error_msg .= qq` [[ message details: to='$to', from='$from', subject='$subj' ]] <br /><br />\n\n`;

			if($die_on_error)	{ die_nice	$error_msg;	}
			else			{ enc_warn	$error_msg;	}
		}

		if($do_fork)
		{
			exit; # exit the child process.
		}
	}

	return ($mail_sent_successfully, $error_msg);
}


sub enc_untaint
{
	my $item = shift || '';
	my $original_item = $item;
	my $keep_path = shift || '';
	#printd "enc_untaint($item)\n";

	# Regardless of whether we're keeping the path, dots surrounded by slashes are never allowed.
	#
	#$item =~ s!(^|/|\\)\.+(/|\\|$)!$1!g;
	$item =~ s!\\!/!g; # Need to remove MS garbage beforehand, otherwise an input like .\\StupidCGI.tmp will break this.
	while($item =~ m!((?:^|/|\\)\.+(?:/|\\|$))!)
	{
		$item =~ s!$1!/!;
	}

	#printd "removed slashdots: $item\n";

	if(  $item =~ m!(/|\\)!  &&  !$keep_path)
	{
		$item =~ s!^.*[/\\]+([^/\\]+)!$1!; # remove any path from the front.
		#printd "removed path from front: $item\n";
		$item =~ s!^([^/\\]+)[/\\]+!$1!; # ...and the back.
	}

	$item =~ s![`\*\?\|<>]!!g; # remove some other potentially-unsafe stuff.

	my $leading_UNC_slashes = '';
	if($item =~ m!^//!  &&  $keep_path)
	{
		$leading_UNC_slashes = '//';
		$item =~ s!^/+!!;
	}
	$item =~ s![/\\]{2,}!/!g; # condense any multiples.
	$item = $leading_UNC_slashes . $item; # add back any UNC slashes.

	($item) = ($item =~ /(.*)/); # untaint.

	# In case anything slips through, die as a security precaution.
	#
	die qq`$0: couldn't untaint "$original_item" [called from: ` . (caller 1)[3]  . qq`].\n` if $item =~ m![/\\]! && !$keep_path;
	die qq`$0: couldn't untaint "$original_item" [called from: ` . (caller 1)[3]  . qq`].\n` if $item =~ m!(?:^|/|\\)\.+(?:/|\\|$)!;
	die qq`$0: couldn't untaint "$original_item" [called from: ` . (caller 1)[3]  . qq`].\n` if $item =~ m!^\.+$!;
	die qq`$0: couldn't untaint "$original_item" [called from: ` . (caller 1)[3]  . qq`].\n` if $item =~ m!^\s*$!;

	#printd "untainted: $item\n\n";
	return $item;
}


sub zeropad
{
	# args: 1. string to pad, 2. length to pad to (i.e. final length).
	enc_pad(@_, 0);
}


sub enc_pad
{
	# args: 1. string to pad, 2. length to pad to (i.e. final length), 3. char to use for padding.
	$_[0] = ($_[2] x $_[1]) . $_[0];
	$_[0] =~ s!.*(.{$_[1]})!$1!;
}


sub enc_urlencode
{
	for(@_) { s/([^\w()'*~!.-])/sprintf '%%%02x', ord $1/eg if $_; };
}


sub enc_urldecode
{
	# assuming the input really was URL-encoded, then any plus-signs that were originally there
	# are now in their hex form, so any plus-signs STILL there were converted from spaces by the
	# browser.  so they must be converted back BEFORE restoring any original plus-signs from the
	# hex codes.
	convert_plus_signs_back_to_spaces_in_var_from_GET_method(@_);
	for(@_) { s/%([a-fA-F\d]{2})/chr hex $1/eg  if $_; }
}


sub zeropad_return { my $string = shift; zeropad($string, @_); return $string; }
sub enc_pad_return { my $string = shift; enc_pad($string, @_); return $string; }
sub enc_urlencode_return { my $string = shift; enc_urlencode($string); return $string; }
sub enc_urldecode_return { my $string = shift; enc_urldecode($string); return $string; }


sub convert_plus_signs_back_to_spaces_in_var_from_GET_method
{
	for(@_) { s/\+/ /g  if $_; }
}


sub enc_redirect
{
	my $destination = shift;

	if($destination =~ /^referr?er$/i)
	{
		$destination = $ENV{HTTP_REFERER} ? $ENV{HTTP_REFERER} : $PREF{redirection_backup_address};
	}

	unless($destination =~ m!^https?://!)
	{
		$destination = $PREF{protoprefix} . $ENV{HTTP_HOST} . $destination;
	}

	my $destination_raw = $destination;
	$destination_raw =~ s!&amp;!&!g;

	if($PREF{output_started})
	{
		if($PREF{use_javascript_redirect_when_necessary} !~ /no/i)
		{
			print qq`\n<script type="text/javascript">location.href="$destination_raw";</script>\n`;
		}
		else
		{
			print qq`<p>$PREF{internal_appname} warning: cannot redirect because output has already started (perhaps debug is enabled?).&nbsp; <a href="$destination">Click here to continue</a>.</p>\n`;
		}
	}
	elsif($PREF{we_are_virtual})
	{
		if($PREF{use_javascript_redirect_when_necessary} !~ /no/i)
		{
			print_http_headers();
			print qq`\n<script type="text/javascript">location.href="$destination_raw";</script>\n`;
		}
		else
		{
			enc_warn "$0: enc_redirect(): cannot redirect because we are virtual.\n";
			print_http_headers();
			print qq`<p>$PREF{internal_appname} warning: cannot redirect because we are virtual.&nbsp; <a href="$destination">Click here to continue</a>.</p>\n`;
		}
	}
	else
	{
		if($ENV{SERVER_SOFTWARE} =~ /microsoft-iis/i || $PREF{always_use_meta_for_redirects} =~ /yes/i)
		{
			# A bug in IIS v5 (and lower, probably) makes cookie-setting fail
			# when combined with a header-based redirect:
			#
			#	"BUG: Set-Cookie Is Ignored in CGI When Combined With Location"
			#	http://support.microsoft.com/kb/q176113/
			#
			# So use a meta-redirect instead.
			#
			print "Content-type: text/html\n\n";
			print qq`<html><head><meta http-equiv="refresh" content="0;url=$destination"></head><body></body></html>\n`;
		}
		else
		{
			print "Location: $destination_raw\n\n";
		}
	}

	exit;
}


sub kmsg_redirect
{
	# Any $PREF{extra_debug} will be lost on redirect unless we store it with the keyed message.
	enc_redirect(   ($PREF{here_static} || $PREF{here}) . "?kmsg=" . store_keyed_message($_[0] . get_extra_debug_output()) . $PREF{default_url_vars}   );
}


sub smsg_redirect
{
	# smsg: static message.  This only needs to be used in situations where we were
	# POSTed to and we want the static message to appear within the page we're
	# embedded into; for non-POST situations we can just use exit_with_error().
	# (And we could use a kmsg instead here, but that does involve some amount
	# of overhead, so for static messages we might as well avoid it.)
	#
	enc_redirect(   ($PREF{here_static} || $PREF{here}) . "?smsg=$_[0]" . $PREF{default_url_vars}   );
}


sub enc_redirect_to_ref
{
	# try to redirect to HTTP_REFERER, falling back to the URL
	# specified by ?whence=foo, then to any passed-in URL, and
	# finally to $PREF{here}.

	my $go = shift;
	if($ENV{HTTP_REFERER})
	{
		$go = $ENV{HTTP_REFERER};
	}
	elsif($qs =~ /(?:^|&)whence=(.+)/)
	{
		$go = $1;
		enc_urldecode($go);
	}
	$go = $PREF{here} if !$go;
	enc_redirect($go);
}


sub get_extra_debug_output
{
	if(	$PREF{extra_debug_always}
		||
		user_is_allowed_to('view_extra_debug_output')
		||
		($PREF{extra_debug_usernames_list} && $PREF{logged_in_username} &&   ($PREF{extra_debug_usernames_list} =~ /(^|,)\s*$PREF{logged_in_username}\s*(,|$)/))
		||
		($PREF{extra_debug_ips_list} &&   ($PREF{extra_debug_ips_list} =~ /(^|,)\s*$PREF{ip}\s*(,|$)/))
	)
	{
		my $style = $PREF{extra_debug_css} || qq`margin: 20px; padding: 10px; border: 1px solid #999; background: #ddd; color: #333; text-align: left;`;
		$PREF{extra_debug} =~ s/</&lt;/g;
		$PREF{extra_debug} =~ s/>/&gt;/g;
		$PREF{extra_debug} =~ s!\n! <br />\n!g;
		my $extra_debug = qq`<div id="extradebug" style="$style">$PREF{extra_debug}</div>\n` unless !$PREF{extra_debug} && $PREF{hide_extra_debug_container_if_empty} =~ /yes/i;
		my $extra_debug_raw = qq`<div id="extradebug_raw" style="$style">$PREF{extra_debug_raw}</div>\n` if $PREF{extra_debug_raw};
		return qq`$extra_debug\n$extra_debug_raw`;
	}
}


sub encdebug { $PREF{extra_debug} .= date14() . ": runtime " . (time - $PREF{app_start_time}) . " sec: " . (caller 1)[3] . ": " . join("\n",@_) . "\n"; }


# This is mainly meant for servers without proper STDERR logging, or
# whose error-log we can't get access to.
#
sub encdebuglog
{
	if($PREF{debuglog} =~ /yes/i)
	{
		my $output = '';
		for(@_)
		{
			$output .= date14() . " pid=$$ runtime=" . (time - $PREF{app_start_time}) . "s user=" . ($PREF{logged_in_username} || '(none)') . " " . (caller 1)[3] . ": $_";
			$output .= "\n" unless $_ =~ /\n$/;
		}
		if($output)
		{
			unless($PREF{debuglogfh})
			{
				#print STDERR "$$: opening the debug log\n";
				open(my $outfh, ">>$PREF{debuglogfile}") or die_nice "couldn't open debug log '$PREF{debuglogfile}' for output: $!\n";
				#flock $outfh, 2;
				$PREF{debuglogfh} = $outfh;
			}
			flock $PREF{debuglogfh}, 2;
			print { $PREF{debuglogfh} } $output;
			flock $PREF{debuglogfh}, 8; # release the lock.
		}
	}
}


sub condense_slashes
{
	s!\\!/!g;
	my $leave_leading_UNC = 0;
	for(@_)
	{
		if(/^leave_leading_UNC$/)
		{
			$leave_leading_UNC = 1;
			next;
		}
		if($leave_leading_UNC)
		{
			my $leading_UNC_slashes = '';
			if(m!^//!)
			{
				$leading_UNC_slashes = '//';
				s!^/+!!;
			}
			s!/{2,}!/!g; # condense any multiples.
			$_ = $leading_UNC_slashes . $_; # add back any UNC slashes.
		}
		else
		{
			s!/{2,}!/!g;
		}
	}
}


sub slashify	{   fooify('/', @_); }
sub deslashify	{ defooify('/', @_); }
sub commaify	{   fooify(',', @_); }
sub decommaify	{ defooify(',', @_); }
sub spaceify	{   fooify(' ', @_); }
sub despaceify	{ defooify(' ', @_); }


sub fooify
{
	# add leading and trailing foos and condense duplicates.
	my $foo = shift;
	$_ = $foo . $_ . $foo for @_;
	s!$foo{2,}!$foo!g for @_;
}


sub defooify
{
	# remove leading and trailing foos and condense duplicates.
	my $foo = shift;
	s!$foo{2,}!$foo!g for @_;
	s!^$foo!!g for @_;
	s!$foo$!!g for @_;
}


sub die_unless_numeric
{
	die_nice("error: non-numeric value '$_[0]' for $_[1]. [called from: " . (caller 1)[3]  . "]\n") unless $_[0] =~ /^\d+$/;
}


sub die_nice
{
	my $msg = shift;
	my $caller = (caller 1)[3];
	$caller =~ s/^main:://;
	$msg = qq`$PREF{internal_appname_nice}: $caller(): $msg` unless $msg =~ /^$PREF{internal_appname}: $caller(): /;
	exit_with_error($msg);
}


sub enc_warn
{
	# Never call the built-in warn() function directly, because some (lame) servers (IIS) choke
	# on it (and on printing to STDERR), and in bad ways, such as prompting the user to download
	# a file (the script output with the error message) rather than just displaying an error.
	#
	return if $^O =~ /MSWin/i;

	my $msg = shift;
	my $caller = (caller 1)[3];
	$caller =~ s/^main:://;
	$msg = qq`$PREF{internal_appname_nice}: $caller(): $msg` unless $msg =~ /^$PREF{internal_appname}: $caller(): /;
	warn $msg;
}


sub pass_child_error_to_parent($$)
{
	my ($record_id, $msg) = @_;
	my $file = $PREF{datadir} . "/ipc_log_for_child_to_parent_communcation.cgi";
	create_file_if_DNE($file, $PREF{writable_file_perms});
	$msg =~ s!\n!ENCNEWLINE!g;
	add_text_to_file("${record_id}:$msg\n", $file, 'end');
}


sub read_child_error($)
{
	my $record_id = shift;
	my $file = $PREF{datadir} . "/ipc_log_for_child_to_parent_communcation.cgi";
	create_file_if_DNE($file, $PREF{writable_file_perms});
	my $msg = '';
	my $found = 0;
	my @contents = ();
	open(my $iofh, "+<$file") or die_nice qq`couldn't open file "$file" for R/W: $!`;
	flock $iofh, 2;
	seek $iofh, 0, 0;
	while(<$iofh>)
	{
		if(/^${record_id}:(.*)$/)
		{
			$found = 1; $msg = $1; chomp $msg; $msg =~ s!ENCNEWLINE!\n!g;
		}
		else
		{
			push @contents, $_;
		}
	}
	if($found)
	{
		seek $iofh, 0, 0;
		print $iofh @contents;
		truncate $iofh, tell $iofh;
	}
	close $iofh or die_nice qq`couldn't close "$file" after R/W: $!`;

	return $msg ? (0,$msg) : (1,'');
}


sub print_http_headers
{
	return if $PREF{output_started} || $PREF{xml_output_started} || $ENV{suppress_http_headers};

	$PREF{output_started} = 1;

	# Don't print the P3P header from here normally, because we'll pick it up automatically
	# from the site's main .htaccess file.  The only time a script needs to explicitly
	# include it is when setting cookies (and possibly when delivering JS code which is
	# used to set cookies?).
	# 
	#print_p3p_header();

	my $noprint = shift;
	my $headers = '';
	$headers .= "Cache-Control: no-store, no-cache\n";
	$headers .= "Connection: close\n"; # workaround for a Safari bug that causes uploads to fail about 50% of the time.
	$headers .= "Content-type: text/html\n\n";
	$noprint ? return $headers : print $headers;
}


sub print_xml_headers()
{
	return if $PREF{output_started} || $PREF{xml_output_started};
	$PREF{xml_output_started} = 1;

	print "Cache-Control: no-store, no-cache\n";
	print "Content-type: text/xml\n";
	print "Connection: close\n"; # workaround for a Safari bug that causes uploads to fail about 50% of the time.
	print "\n";
}


sub print_p3p_header
{
	# If you need to set third-party cookies, you'll need to use the P3P
	# privacy policy system, or else IE will reject the cookies.  The system
	# consists of a /w3c folder on your website containing a p3p.xml file
	# and a policy.html file, and then having your server send a P3P header,
	# both in the main .htaccess file and anytime a script needs to output
	# headers.  The value should be something like this:
	#
	#	$PREF{p3p_header} = qq`P3P: CP="ALL DSP COR NID", policyref="/w3c/p3p.xml"`;
	#
	# Or, you can leave off the policyref:
	#
	#	$PREF{p3p_header} = qq`P3P: CP="ALL DSP COR NID"`;
	#
	# You may want to use a service like http://p3pedit.com/ to create your
	# XML and privacy files.  And you can use www.w3.org/P3P/validator.html
	# to validate your setup.

	return if $PREF{p3p_header_printed};

	$PREF{p3p_header_printed} = 1;
	my $noprint = shift;
	my $headers = '';
	$headers .= "$PREF{p3p_header}\n" if $PREF{p3p_header};
	$noprint ? return $headers : print $headers;
}


sub offsettime	{ return time + $PREF{time_offset}; }
sub date8	{ return strftime("%Y%m%d", localtime(shift || offsettime())); }
sub date14	{ return strftime("%Y%m%d-%H%M%S", localtime(shift || offsettime())); }
sub date17	{ return strftime("%Y%m%d-%H:%M:%S", localtime(shift || offsettime())); }


sub offset_etime($$)
{
	my ($etime, $offset) = @_;
	my ($operation, $amount, $multiplier_code) = ($offset =~ /([\+-])(\d+)([smhdb])/);
	my $multiplier = $multiplier_code eq 'm' ? 60 : $multiplier_code eq 'h' ? 3600 : $multiplier_code eq 'd' ? 86400 : 1;
	if($multiplier_code eq 'b')
	{
		while($amount)
		{
			do { $etime = $operation eq '+' ? $etime + 86400 : $etime - 86400; } while is_weekend($etime);
			$amount--;
		}
	}
	else
	{
		$etime = $operation eq '+' ? $etime + ($amount * $multiplier) : $etime - ($amount * $multiplier);
	}
	return $etime;
}


sub is_weekend($)
{
	return (localtime($_[0]))[6] =~ /[06]/; # (localtime($etime))[6] is the weekday, with 0 being Sunday and 6 being Saturday.
}


sub sql_untaint
{
	s/"/&quot;/g for @_;
	s/'/&#39;/g for @_;
	s/`/&#96;/g for @_;
	s/\\/&#92;/g for @_;
}


sub sql_un_untaint
{
	s/&quot;/"/g for @_;
	s/&#39;/'/g for @_;
	s/&#96;/`/g for @_;
	s/&#92;/\\/g for @_;
}


sub enc_hash
{
	return $PREF{use_md5_for_hashes} =~ /yes/i ? md5_hex(@_) : sha1_hex(@_);
}


sub not_sqlsafe
{
	#print STDERR "not_sqlsafe: got: $_[0]\n";

	# Escape any dashes or closing brackets, as per perlre:
	#
	# 	If you want either "-" or "]" itself to be a member of a class,
	#	put it at the start of the list (possibly after a "^"), or escape
	#	it with a backslash.
	#
	my $list_of_sql_safe_characters = $PREF{list_of_sql_safe_characters};
	$list_of_sql_safe_characters =~ s/\]/\\]/g;
	$list_of_sql_safe_characters =~ s/-/\\-/g;

	return $_[0] =~ /[^$list_of_sql_safe_characters]/;
}


sub die_unless_sqlsafe
{
	#print STDERR "die_unless_sqlsafe: got: $_[0]\n";

	# Escape any dashes or closing brackets, as per perlre:
	#
	# 	If you want either "-" or "]" itself to be a member of a class,
	#	put it at the start of the list (possibly after a "^"), or escape
	#	it with a backslash.
	#
	my $list_of_sql_safe_characters = $PREF{list_of_sql_safe_characters};
	$list_of_sql_safe_characters =~ s/\]/\\]/g;
	$list_of_sql_safe_characters =~ s/-/\\-/g;

	for(@_)
	{
		if(/[^$list_of_sql_safe_characters]/)
		{
			enc_warn "Not SQL safe: '$_'; \$list_of_sql_safe_characters=$list_of_sql_safe_characters\n";
			exit_with_error(qq`Not SQL-safe: called from ` . (caller 1)[3] . qq`: the following value is not SQL-safe: $_`);
		}
	}
}


sub replace_nonsqlsafe_chars_with
{
	my $replacement = shift;

	# Escape any dashes or closing brackets, as per perlre:
	#
	# 	If you want either "-" or "]" itself to be a member of a class,
	#	put it at the start of the list (possibly after a "^"), or escape
	#	it with a backslash.
	#
	my $list_of_sql_safe_characters = $PREF{list_of_sql_safe_characters};
	$list_of_sql_safe_characters =~ s/\]/\\]/g;
	$list_of_sql_safe_characters =~ s/-/\\-/g;

	for(@_)
	{
		if(/[^$list_of_sql_safe_characters]/)
		{
			enc_warn "sanitizing the following non-SQL-safe value: $_\n";
			s/[^$list_of_sql_safe_characters]/$replacement/g;
		}
	}
}


sub oddeven
{
	$_[0] = 0 unless $_[0] && $_[0] =~ /^\d+$/;
	$_[0]++ unless $_[1] eq 'dont_inc';
	return $_[1] && $_[1] eq 'reset' ? 'odd' : $_[0] % 2 == 0 ? 'even' : 'odd';
}


sub enc_sql_select($)
{
	verify_db_connection();
	my $statement = shift;
	#encdebug "enc_sql_select: statement is: $statement";
	my $sth = $PREF{dbh}->prepare($statement);
	$sth->execute() or die_nice("called from " . (caller 1)[3]  . ": error while executing SQL select statement [[$statement]]: $DBI::errstr\n");
	return $sth->fetchrow;
}


sub enc_sql_select_multi($)
{
	verify_db_connection();
	my $statement = shift;
	my $sth = $PREF{dbh}->prepare($statement);
	$sth->execute() or die_nice("called from " . (caller 1)[3]  . ": error while executing SQL select statement [[$statement]]: $DBI::errstr\n");
	my $i = 1;
	my %hash = ();
	my $rowhashref = '';
	while($rowhashref = $sth->fetchrow_hashref)
	{
		foreach my $field (keys %$rowhashref)
		{
			$hash{$i}{$field} = $$rowhashref{$field};
		}
		$i++;
	}
	return \%hash;
}


sub enc_sql_select_array
{
	my $statement = shift;
	my $sth = $PREF{dbh}->prepare($statement);
	$sth->execute() or die_nice("called from " . (caller 1)[3]  . ": error while executing SQL select statement [[$statement]]: $DBI::errstr\n");
	my @results = ();
	while(my $ref = $sth->fetchrow_arrayref()) 
	{
		push @results, @{$ref};
	}
	return @results;
}


sub enc_sql_update($)
{
	verify_db_connection();
	my $statement = shift;
	my $sth = $PREF{dbh}->prepare($statement);
	my $numrows = $sth->execute() or die_nice("called from " . (caller 1)[3]  . ": error while executing SQL update statement [[$statement]]: $DBI::errstr\n");
	return $numrows;
}


sub enc_sql_insert($)
{
	verify_db_connection();
	my $statement = shift;
	my $sth = $PREF{dbh}->prepare($statement);
	$sth->execute() or die_nice("called from " . (caller 1)[3]  . ": error while executing SQL insert statement: $DBI::errstr.  Statement was: [[ $statement ]]\n");
}


sub enc_sql_delete($)
{
	verify_db_connection();
	my $statement = shift;
	my $sth = $PREF{dbh}->prepare($statement);
	my $retval = $sth->execute();
	die_nice("called from " . (caller 1)[3]  . ": error while executing SQL delete statement: $DBI::errstr.  Statement was: [[ $statement ]]\n") if $retval =~ /^(0|0E0)$/; # execute() returns '0E0' if no rows were affected by the statement.
}


sub enc_sys_call
{
	# TODO: this doesn't always work.

	my $cmd = shift;
	my ($msg,$success) = ();

	if(my $timeout = $PREF{sys_call_timeout})
	{
		eval
		{

		local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required
		alarm $timeout;

		# Note: don't change this without changing the matching block below.
		system($cmd);
		if ($? == -1)		{ $success = 0; $msg = "error: failed to execute: $!"; }
		elsif ($? & 127)	{ $success = 0; $msg = sprintf "error: child died with signal %d, %s coredump", ($? & 127),  ($? & 128) ? 'with' : 'without'; }
		else			{ $success = 1; $msg = sprintf "child exited with value %d", $? >> 8; }

		};

		if($@)
		{
			if($@ eq "alarm\n")
			{
				# timed out.
				$success = 0; $msg = "error: timeout while executing: $!";
			}
			else
			{
				# propagate unexpected errors.
				$success = 0; $msg = "unexpected error while executing: $@";
			}
		}
		else
		{
			# didn't time out.
		}
	}
	else
	{
		# Note: don't change this without changing the matching block above.
		system($cmd);
		if ($? == -1)		{ $success = 0; $msg = "error: failed to execute: $!"; }
		elsif ($? & 127)	{ $success = 0; $msg = sprintf "error: child died with signal %d, %s coredump", ($? & 127),  ($? & 128) ? 'with' : 'without'; }
		else			{ $success = 1; $msg = sprintf "child exited with value %d", $? >> 8; }
	}

	$msg = "enc_sys_call(): command was [[ $cmd ]]; result was [[ $msg ]];";
	printd "$msg\n";

	$PREF{sys_call_timeout} = 0; # always reset this so it's disabled by default, and the caller can choose to set it before calling us if necessary.
	return ($success, $msg);
}


sub exit_with_error { $PREF{static_error_message} ? print_and_exit($PREF{static_error_message}) : exit_with___generic($PREF{error_message_template}, @_); } # Errors that the end-user is supposed to see.
sub exit_with_success { exit_with___generic($PREF{success_message_template}, @_); } # Success messages that the end-user is supposed to see.
sub exit_with_notice { exit_with___generic($PREF{notice_message_template}, @_); } # Non-error messages that the end-user is supposed to see.
sub exit_with_output { exit_with___generic('', @_); } # For any output; no template will be used.


sub print_and_exit
{
	# This sub should NOT include any full HTML output, headers/footers, etc.  Just the bare minimum necessary to display the string it receives.
	print_http_headers(); print @_; exit;
}


sub exit_with___generic
{
	my $template = shift;
	my $message = join '', @_;
	#print STDERR $message;
	$template =~ s/%%message%%/$message/g;
	$message = $template =~ /\Q$message\E/ ? $template : $message; # in case prefs haven't been loaded yet.
	if(!$PREF{we_are_virtual} && $PREF{here} ne $ENV{SCRIPT_NAME} && $ENV{REQUEST_METHOD} =~ /post/i)
	{
		# 20081213: added method=post requirement; otherwise, if $PREF{here} is set to something other than
		# $ENV{SCRIPT_NAME}, then visiting the script directly will trigger this, which isn't what we want.
		# TODO: should method=post be the ONLY requirement for this if()?

		# Any $PREF{extra_debug} will be lost on redirect unless we store it with the keyed message.
		enc_redirect(   ($PREF{here_static} || $PREF{here}) . "?kmsg=" . store_keyed_message($message . get_extra_debug_output())   );
	}
	else
	{
		start_html_output('');
		print $message;
		finish_html_output();
	}
	exit;
}


sub exit_with_kmsg
{
	start_html_output('');
	print get_keyed_message($_[0]);
	finish_html_output();
	exit;
}


sub exit_with_needlogin
{
	start_html_output('');
	$PREF{needlogin_message} =~ s/%%login_url%%/$PREF{login_url}/g;
	print $PREF{needlogin_message};
	finish_html_output();
	exit;
}


sub exit_with_needprivs
{
	my $whenceqs = $qs; $whenceqs =~ s!&!_ANAMP_!g;
	my $login_url = '';
	if(userbase_available() || $PREF{integrate_with_existing_login_system} =~ /yes/i)
	{
		$login_url = $PREF{login_url_qsready};
	}
	else
	{
		$login_url = "$PREF{here_login_qsready}action=" . ($PREF{internal_appname} =~ /visitorlog/i ? 'vllogin' : 'login') . '&amp;';
	}
	$login_url .= ($PREF{default_url_vars} ? "$PREF{default_url_vars}&amp;" : "") . "needprivs=true&amp;whence=$PREF{REQ_URI_SANS_QS}" . ($whenceqs ? "_THEQS_$whenceqs" : '');
	$login_url = "$PREF{protoprefix}$ENV{HTTP_HOST}$login_url" unless $login_url =~ /^https?:/;
	my $js_login_url = $login_url; $js_login_url =~ s!&amp;!&!g;

	my $auto_redirect = qq`<script type="text/javascript">location.href="$js_login_url";</script>\n`;

	$PREF{needprivs_message} =~ s/%%login_url%%/$login_url/g;
	$PREF{needprivs_message} =~ s/%%js_auto_redirect%%/$PREF{member_is_logged_in} ? '' : $auto_redirect/eg;
	$PREF{needprivs_message} =~ s/%%%if-notloggedin%%%(.+?)%%%end-notloggedin%%%/$PREF{member_is_logged_in} ? '' : $1/egs;

	start_html_output('Authentication Required');
	print $PREF{needprivs_message};
	finish_html_output();
	exit;
}


sub printd
{
	my $msg = shift;
	chomp $msg;
	$msg = "$PREF{internal_appname}-debug: " . (offsettime()) . ": $msg";
	if($PREF{debug} || $PREF{force_debug} =~ /yes/i || $debuglog)
	{
		enc_warn "$msg\n";
		encdebug $msg;
		print $debuglog "$msg\n" if $debuglog;
	}
	if($PREF{debug})
	{
		#print_http_headers();
		#print "<!-- $msg -->\n";
	}
}


# Some SQL implementations support other nonsense in the table names; we'll restrict to a sensible set of characters.
#
sub tablename_is_valid				{ return ($_[0] =~ /^\w+$/	&&						length($_[0]) <= $PREF{max_tablename_length});		}
sub check_tablename_for_sql_safeness		{ die_nice("Invalid tablename: '$_[0]'") unless tablename_is_valid($_[0]); 								}


sub get_db_connection
{
	eval { require DBI; }; die_nice qq`error while trying to load the DBI module.&nbsp; You probably need to <a href="http://encodable.com/perl_modules/" target="_blank">install the Perl module</a> for it.&nbsp; The error message was: <br /><br />\n\n $0: $@\n` if $@;
	if(!$PREF{dbh}   ||   $_[0] eq 'force')
	{
		my $dbname = $PREF{database_name};
		$dbname .= ":$PREF{database_hostname}" if $PREF{database_hostname};
		$PREF{dbi_connection_string} =~ s!%%dbname%%!$dbname!g;

		$PREF{dbh} = DBI->connect($PREF{dbi_connection_string}, $PREF{database_username}, $PREF{database_password})
				or exit_with_error("Error: $DBI::errstr <br /><br />\n\nPlease verify your settings for the following preferences: \$PREF{database_hostname}, \$PREF{database_name}, \$PREF{database_username}, \$PREF{database_password}.");

		# 20090425: there's a bug somewhere in the Perl MySQL stack which causes the
		# database connection to be silently dropped in some cases, resulting in the
		# Perl script simply dying (segfaulting?) when attempting to use the connection.
		# This happens even though mysql_auto_reconnect is enabled; disabling that
		# causes the script to die with the "MySQL server has gone away" error, instead
		# of dying silently.  Furthermore, with mysql_auto_reconnect enabled, the Perl
		# script will also segfault if you call $dbh->ping() after the connection has
		# been lost, making it totally worthless for its intended purpose.  The root
		# cause of this issue may be the following DBD-mysql bug:
		#
		#	http://rt.cpan.org/Public/Bug/Display.html?id=37027
		#
		# That bug report hasn't been updated since October of 2008, and the bug still
		# exists as of April 2009, so as a workaround, we'll disable mysql_auto_reconnect
		# and then always do a $dbh->ping() before every database communication.
		#
		$PREF{dbh}->{mysql_auto_reconnect} = 0;
	}
}


sub verify_db_connection
{
	get_db_connection('force') unless $PREF{dbh} && $PREF{dbh}->ping;
}


sub db_column_exists($$)
{
	my $column_to_find = shift;
	my $table_name = shift;

	verify_db_connection();
	check_tablename_for_sql_safeness($table_name);

	my ($column_name, $temp) = ('','');
	my $sth = $PREF{dbh}->prepare("SHOW COLUMNS FROM `$table_name`;");
	$sth->execute() or die_nice "Error: $DBI::errstr\n";
	$sth->bind_columns(\$column_name, \$temp, \$temp, \$temp, \$temp, \$temp);
	while($sth->fetchrow_arrayref)
	{
		#print STDERR "column_name='$column_name', column_to_find='$column_to_find'\n";

		#return 1 if $column_name eq $column_to_find;
		#
		# MySQL returns a "Duplicate column name" error if you try to create a column
		# named (for example) "Color" when there's already one named "color":
		#
		return 1 if lc($column_name) eq lc($column_to_find);
	}
	return 0;
}


sub db_table_exists($)
{
	my ($table_to_check, $table, $table_exists) = (shift, '', 0);
	my $sth = $PREF{dbh}->prepare(qq`show tables;`);
	$sth->execute();
	$sth->bind_columns(\$table);
	while($sth->fetchrow_arrayref)
	{
		if($table eq $table_to_check)
		{
			$table_exists = 1;
			last;
		}
	}
	return $table_exists;
}


sub get_db_colnames($)
{
	my $table = shift;
	check_tablename_for_sql_safeness($table);
	my $colnames = '';
	my $column_name = '';
	my $temp = '';
	my $sth = $PREF{dbh}->prepare("SHOW COLUMNS FROM `$table`;");
	$sth->execute() or die_nice "$0: Error: db_column_exists(): $DBI::errstr\n";
	$sth->bind_columns(\$column_name, \$temp, \$temp, \$temp, \$temp, \$temp);
	while($sth->fetchrow_arrayref)
	{
		$colnames .= $column_name . ',';
	}
	$colnames =~ s/,$//;
	return $colnames;
}


sub get_ip_and_host
{
	# Some hosting companies (Yahoo) set REMOTE_ADDR to their own IP (it's a cache or proxy or something)
	# and then set the true end-user IP in a different ENV var, so if those exist, use them instead.
	#
	my $ip = $ENV{HTTP_YAHOOREMOTEIP} || $ENV{HTTP_X_FORWARDED_FOR} || $ENV{HTTP_CLIENT_IP} || $ENV{REMOTE_ADDR};
	my $host = $ENV{REMOTE_HOST};

	if((!$host) || ($host !~ /\w\.\w/)) { $host = $ip; }
	if($host eq $ip)
	{
		use Socket;
		$host = gethostbyaddr(inet_aton($ip), AF_INET);
	}
	if((!$host) || ($host !~ /\w\.\w/)) { $host = $ip; }

	return ($ip, $host);
}


sub populate_month_conversion_hashes
{
	$PREF{monthnum}{jan}='01';
	$PREF{monthnum}{feb}='02';
	$PREF{monthnum}{mar}='03';
	$PREF{monthnum}{apr}='04';
	$PREF{monthnum}{may}='05';
	$PREF{monthnum}{jun}='06';
	$PREF{monthnum}{jul}='07';
	$PREF{monthnum}{aug}='08';
	$PREF{monthnum}{sep}='09';
	$PREF{monthnum}{oct}='10';
	$PREF{monthnum}{nov}='11';
	$PREF{monthnum}{dec}='12';

	$PREF{monthnum}{january}='01';
	$PREF{monthnum}{february}='02';
	$PREF{monthnum}{march}='03';
	$PREF{monthnum}{april}='04';
	$PREF{monthnum}{may}='05';
	$PREF{monthnum}{june}='06';
	$PREF{monthnum}{july}='07';
	$PREF{monthnum}{august}='08';
	$PREF{monthnum}{september}='09';
	$PREF{monthnum}{october}='10';
	$PREF{monthnum}{november}='11';
	$PREF{monthnum}{december}='12';

	$PREF{monthname}{"01"} = 'Jan';
	$PREF{monthname}{"02"} = 'Feb';
	$PREF{monthname}{"03"} = 'Mar';
	$PREF{monthname}{"04"} = 'Apr';
	$PREF{monthname}{"05"} = 'May';
	$PREF{monthname}{"06"} = 'Jun';
	$PREF{monthname}{"07"} = 'Jul';
	$PREF{monthname}{"08"} = 'Aug';
	$PREF{monthname}{"09"} = 'Sep';
	$PREF{monthname}{"10"} = 'Oct';
	$PREF{monthname}{"11"} = 'Nov';
	$PREF{monthname}{"12"} = 'Dec';
}


sub save_php_var_to_cache($$)
{
	my $new_var = shift;
	my $new_value = shift;
	my $new_date = offsettime();
	my $new_sessid = get_cookie($PREF{php_session_cookie_name});
	die_nice qq`couldn't determine PHP session ID from cookie; perhaps you need to adjust \$PREF{php_session_cookie_name} (currently '$PREF{php_session_cookie_name}')?` unless $new_sessid; # if there's no sessionid, we have no way to index into the cache file.
	for($new_var, $new_value, $new_date, $new_sessid)
	{
		s/:::::/ENCFIVECOLONS/g;
		s/\n/ENCNEWLINE/g;
	}
	my ($session_found, $var_found) = ();

	create_file_if_DNE($PREF{php_session_cache_file},$PREF{writable_file_perms});
	my @new_contents = ();
	open(CACHEFH,"+<$PREF{php_session_cache_file}") or die_nice("couldn't open cache file '$PREF{php_session_cache_file}' for R/W: $!\n");
	my $iofh = \*CACHEFH;
	flock $iofh, 2;
	seek $iofh, 0, 0;
	while(<$iofh>)
	{
		if(/^date=(\d+?):::::sessid=(\w+?):::::.+/)
		{
			chomp;
			my ($date, $sessid) = ($1, $2);
			if($new_date - $date < $PREF{php_session_cache_ttl})
			{
				if($sessid ne $new_sessid)
				{
					# If this record doesn't belong to the current user, don't bother processing it.
					push (@new_contents, "$_\n");
				}
				else
				{
					$session_found = 1;
					my $new_line = "date=${date}:::::sessid=${sessid}:::::";
					foreach my $var (split(/:::::/))
					{
						my ($name,$value) = ($var =~ /(\w+)=(.*)/);
						next if $name =~ /^(date|sessid)$/i;
						if($name eq $new_var)	{ $new_line .= "$name=${new_value}:::::"; $var_found = 1; }
						else			{ $new_line .= "$name=${value}:::::"; }
					}
					$new_line .= "$new_var=${new_value}:::::" if !$var_found;
					push (@new_contents, "$new_line\n");
				}
			}
		}
	}
	push (@new_contents, "date=${new_date}:::::sessid=${new_sessid}:::::$new_var=${new_value}:::::\n") if !$session_found;
	seek $iofh, 0, 0;
	print $iofh @new_contents;
	truncate $iofh, tell $iofh;
	close $iofh or die_nice("couldn't close cache file '$PREF{php_session_cache_file}' after R/W: $!\n");
}


sub get_php_var_from_cache($)
{
	my $new_var = shift;
	my $new_value = '';
	my $new_date = offsettime();
	my $new_sessid = get_cookie($PREF{php_session_cookie_name});
	die_nice qq`couldn't determine PHP session ID from cookie; perhaps you need to adjust \$PREF{php_session_cookie_name} (currently '$PREF{php_session_cookie_name}')?` unless $new_sessid; # if there's no sessionid, we have no way to index into the cache file.
	for($new_var, $new_value, $new_date, $new_sessid)
	{
		s/:::::/ENCFIVECOLONS/g;
		s/\n/ENCNEWLINE/g;
	}

	create_file_if_DNE($PREF{php_session_cache_file},$PREF{writable_file_perms});
	open(CACHEFH,"<$PREF{php_session_cache_file}") or die_nice("couldn't open cache file '$PREF{php_session_cache_file}' for reading: $!\n");
	my $infh = \*CACHEFH;
	flock $infh, 1;
	seek $infh, 0, 0;
	while(<$infh>)
	{
		if(/^date=(\d+?):::::sessid=(\w+?):::::.+/)
		{
			my ($date, $sessid) = ($1, $2);
			if($new_date - $date < $PREF{php_session_cache_ttl}   &&   $sessid eq $new_sessid)
			{
				if(/(?:^|:::::)$new_var=(.*?)(?::::::|$)/) { $new_value = $1; }
			}
		}
	}
	close $infh or die_nice("couldn't close cache file '$PREF{php_session_cache_file}' after reading: $!\n");
	return $new_value;
}


sub cache_and_read_any_nonpost_env_vars()
{
	$PREF{nonpost_env_var_cache_ttl} = 60*60*24 unless $PREF{nonpost_env_var_cache_ttl} =~ /^\d+$/; # in seconds.
	my $file = $PREF{datadir} . '/cache_for_nonpost_env_vars.cgi';
	create_file_if_DNE($file, $PREF{writable_file_perms});
	my $current_date = offsettime();
	my (%live_env_vars, %cached_env_vars, %live_env_vars_missing_from_cache, %cached_env_vars_that_need_to_be_updated) = ();
	my ($expired_records, @records_from_other_users, @cached_env_vars_missing_from_live_env, @unchanged_cached_env_vars) = ();

	foreach my $var (sort keys %ENV)
	{
		$live_env_vars{$var} = $ENV{$var} if(

			($var =~ /^PHP/)
			
			||
			
			($PREF{enable_username_from_environment_variable} =~ /yes/i   &&   $var eq $PREF{username_envvar_name})
			
		);
	}
	if(%live_env_vars)
	{
		open(my $iofh, "+<$file") or die_nice qq`couldn't open file '$file' for R/W: $!`;
		flock $iofh, 2;
		seek $iofh, 0, 0;
		while(<$iofh>)
		{
			chomp;
			if(/^date=(\d+):::::encvisid=(\w+):::::(\w+)=(.*)/)
			{
				my ($date, $encvisid, $var, $value) = ($1, $2, $3, $4);
				if($current_date - $date < $PREF{nonpost_env_var_cache_ttl})
				{
					if($encvisid eq $PREF{enc_visitor_id})
					{
						$value =~ s!ENCNEWLINE!\n!g;

						$cached_env_vars{$var} = $value;
						if(! exists $ENV{$var})
						{
							push (@cached_env_vars_missing_from_live_env, "$_\n");
						}
						elsif($cached_env_vars{$var} ne $ENV{$var})
						{
							$cached_env_vars_that_need_to_be_updated{$var} = $ENV{$var};
						}
						else
						{
							push (@unchanged_cached_env_vars, "$_\n");
						}
					}
					else
					{
						# If this record doesn't belong to the current user, don't bother processing it.
						push (@records_from_other_users, "$_\n");
					}
				}
				else
				{
					$expired_records = 1;
				}
			}
		}
		foreach my $var (sort keys %live_env_vars)
		{
			if(! exists $cached_env_vars{$var})
			{
				$live_env_vars_missing_from_cache{$var} = $live_env_vars{$var};
			}
		}

		my @new_contents = ();
		if($expired_records || %live_env_vars_missing_from_cache || %cached_env_vars_that_need_to_be_updated)
		{
			foreach my $var (keys %live_env_vars_missing_from_cache)
			{
				my $value = $live_env_vars_missing_from_cache{$var}; $value =~ s!\n!ENCNEWLINE!g;
				push @new_contents, "date=${current_date}:::::encvisid=$PREF{enc_visitor_id}:::::${var}=${value}\n";
			}
			foreach my $var (keys %cached_env_vars_that_need_to_be_updated)
			{
				my $value = $cached_env_vars_that_need_to_be_updated{$var}; $value =~ s!\n!ENCNEWLINE!g;
				push @new_contents, "date=${current_date}:::::encvisid=$PREF{enc_visitor_id}:::::${var}=${value}\n";
			}
			push @new_contents, @cached_env_vars_missing_from_live_env;
			push @new_contents, @unchanged_cached_env_vars;
			push @new_contents, @records_from_other_users;
			
			seek $iofh, 0, 0;
			print $iofh @new_contents;
			truncate $iofh, tell $iofh;
		}

		close($iofh) or die_nice qq`couldn't close file '$file' after R/W: $!`;
	}
	else
	{
		# We were POSTed to?  So populate the live %ENV with any cached nonpost vars for this user.

		if(-s $file) # don't bother opening/closing the file if it's empty.
		{
			open(my $infh, $file) or die_nice qq`couldn't open file '$file' for reading: $!`;
			flock $infh, 1;
			seek $infh, 0, 0;
			while(<$infh>)
			{
				chomp;
				if(/^date=(\d+):::::encvisid=$PREF{enc_visitor_id}:::::(\w+)=(.*)/)
				{
					my ($date, $var, $value) = ($1, $2, $3);
					if($current_date - $date < $PREF{nonpost_env_var_cache_ttl})
					{
						$value =~ s!ENCNEWLINE!\n!g;
						$ENV{$var} = $value;
					}
				}
			}
			close($infh) or die_nice qq`couldn't close file '$file' after reading: $!`;
		}
	}
}


sub do_email_test
{
	my $to		= $PREF{email_test_recipient};
	my $from	= $PREF{email_test_sender};

	if($PREF{admin_is_logged_in})
	{
		$to = get_qs_var('to') if is_valid_email_address(get_qs_var('to'));
		$from = get_qs_var('from') if is_valid_email_address(get_qs_var('from'));
	}

	my $subj	= "test message - $PREF{date14} - $ENV{HTTP_HOST}";
	my $format	= $PREF{mailtest_email_format} || $PREF{global_email_format};
	my $die		= get_qs_var('die') eq '0' ? '' : 'die_on_email_error';

	my $authname	= $PREF{smtp_auth_username} ? 'not null' : 'null';
	my $authpass	= $PREF{smtp_auth_password} ? 'not null' : 'null';

	eval { require MIME::Lite; };
	my $mimelite_available = $@ ? "it's not" : "it is";

	my $sendmail_available = -e $PREF{path_to_sendmail} ? "it does" : "it doesn't";

	my $msg		= qq`this is only a test.
email settings:
\$PREF{smtp_server}		='$PREF{smtp_server}'
\$PREF{path_to_sendmail}	='$PREF{path_to_sendmail}'
\$PREF{smtp_auth_username}	is $authname.
\$PREF{smtp_auth_password}	is $authpass.
`;

	send_email($to, $from, $subj, $msg, $format, $die);

	my $output = qq`Sent test message from "$from" to "$to"; no immediate error occurred. <br /><br />\n\nIf the MIME::Lite Perl module is installed ($mimelite_available) and if \$PREF{smtp_server} is not null (it's "$PREF{smtp_server}"), then we tried to send the email using SMTP. <br /><br />\n\nIf your sendmail executable exists ($sendmail_available) (specified by \$PREF{path_to_sendmail}, currently "$PREF{path_to_sendmail}"), then we tried to send the email using sendmail, too.`;
	$output .= qq`<br /><br />\n\nNote: since you're an admin, you can also pass to=(address), from=(address), and die=(0|1) on the URL.` if $PREF{admin_is_logged_in};
	exit_with_notice($output);
}


sub add_text_to_file($$$)
{
	# Note: this function doesn't automatically insert any newlines; it
	# only inserts precisely what it receives in the $text parameter.

	my ($text, $file, $position) = @_;
	open(my $iofh, "+<$file") or die_nice "couldn't open file '$file' for R/W: $!\n";
	flock $iofh, 2;

	if($position eq 'start')
	{
		seek $iofh, 0, 0;
		my @contents = <$iofh>;
		seek $iofh, 0, 0;
		print $iofh $text;
		print $iofh @contents;
	}
	else
	{
		seek $iofh, 0, 2;
		print $iofh $text;
	}

	truncate $iofh, tell $iofh;
	close $iofh or die_nice "couldn't close file '$file' after R/W: $!\n";
}


sub get_database_data
{
	$PREF{on_page} = 'default';
	my ($tableprefname,$viewerprefname,$allowed_to_view,$allowed_to_create,$allowed_to_edit,$allowed_to_delete) = @_;
	my $dbtable = $PREF{$tableprefname} || $tableprefname; # "$tableprefname" can be the name of the pref OR of the table.
	my $createmode = 0;
	my $editmode = 0;
	my $row_id_to_edit = 0;

	if((my $ref = $ENV{HTTP_REFERER}) && $qs !~ /(?:^|&)dbvwrwhence=.+/)
	{
		$ref =~ s!\?!_encrplcdqm_!g;
		$ref =~ s!&!_encrplcdamp_!g;
		$ref =~ s!^https?://!!;
		$ref =~ s!^$ENV{HTTP_HOST}!!;
		$ref .= '_dbvwrwhncend_';
		$qs .= "&dbvwrwhence=$ref";
		$ENV{REQUEST_URI} .= $ENV{REQUEST_URI} =~ /\?/ ? "&dbvwrwhence=$ref" : "?dbvwrwhence=$ref"
	}
	if($qs =~ /(?:^|&)dbvwrwhence=(.+)_dbvwrwhncend_/)
	{
		$PREF{dbvwrwhence} = $1;
		$PREF{dbvwrwhence} =~ s!_encrplcdqm_!?!g;
		$PREF{dbvwrwhence} =~ s!_encrplcdamp_!&!g;
	}

	my $hiddencols			= $PREF{"${viewerprefname}_viewer_hidden_columns"} unless $qs =~ /allfields=true/;   # TODO: add UI for allfields=true.
	my $disabledcols		= $PREF{"${viewerprefname}_viewer_disabled_columns"};
	my $display_length		= $PREF{"${viewerprefname}_viewer_max_display_length"} || 500;
	my $pagetitle			= $PREF{"${viewerprefname}_viewer_title"};
	my $template			= $PREF{"${viewerprefname}_viewer_template"} || qq`\n%%header_note%%\n%%%if-db_view_controls%%%<p>[ %%db_view_controls%% ]</p>\n%%%end-db_view_controls%%%<br />\n%%output%%\n<p>%%pagelinks%%</p>\n%%search_form%%\n%%footer_note%%\n`;
	my @template_viewcontrols	= $PREF{"${viewerprefname}_viewer_template_viewcontrols"} || (qq`%%horizlink:text=Horizontal%%`, qq`%%vertlink:text=Vertical%%`, qq`%%viewalllink:text=View All%%`);
	my $template_viewcontrols_sep	= $PREF{"${viewerprefname}_viewer_template_viewcontrols_separator"} || ' | ';
	$template			=~ s!%%header_note%%!<div class="database_header_note">$PREF{"${viewerprefname}_viewer_header_note"}</div>!g;
	$template			=~ s!%%footer_note%%!$PREF{"${viewerprefname}_viewer_footer_note"}!g;
	my $itemsperpage		= $PREF{"${viewerprefname}_viewer_itemsperpage"} || 10;
	my $extra_columns		= \%{$PREF{"${viewerprefname}_viewer_extra_columns"}};
	my %db_update_details		= ( table => $dbtable, viewerprefname => $viewerprefname );

	my $creation_title_transforms	= \%{$PREF{"${viewerprefname}_creation_title_transforms"}};
	my $editmode_title_transforms	= \%{$PREF{"${viewerprefname}_editmode_title_transforms"}};
	my $viewer_title_transforms	= \%{$PREF{"${viewerprefname}_viewer_title_transforms"}};
	my $viewer_value_transforms	= \%{$PREF{"${viewerprefname}_viewer_value_transforms"}};
	my %custom_titles		= ();

	my $selection_restrictions	= $PREF{"${viewerprefname}_viewer_selection_restrictions"};
	my $editmode_restrictions	= $PREF{"${viewerprefname}_editmode_restrictions"};
	
	$PREF{"${viewerprefname}_viewer_db_url"}	||= "$PREF{here_qsready}action=" . get_qs_var('action');
	$PREF{"${viewerprefname}_viewer_db_url_full"}	||= $PREF{protoprefix} . $ENV{HTTP_HOST} . $PREF{"${viewerprefname}_viewer_db_url"}; # for within emails, etc.

	# extra_columns have a position within the displayed table, and a value, although
	# the value will often be null because it'll instead be set by a transform.  set
	# their position to >1000 in order to put them at the end of the table.
	#
	# title_transforms just change the header text for the specified column.
	#
	# value_transforms use "%%variable%%" to refer to the name/value of their own column, and
	# can also use %%foo%%, where foo is the name of any other column in the same table.
	#
	# _editmode_frontend_value_transforms are viewer transforms specifically for edit-mode;
	# they transform the values that pre-populate the form when editing a record.  So they
	# don't transform the backend (i.e. the POST side) at all.
	#
	# You can pass ?raw$columnname=yes on the URL to display that column's values in their
	# raw form, with any viewer transformations disabled.

	my ($range_start,$range_end,$sql_range_start) = get_pagination_range($itemsperpage);

	if($allowed_to_create)
	{
		$createmode = 1 if get_qs_var('createmode') eq 'true';
	}

	if($allowed_to_edit)
	{
		# Nothing in here should need editing.
		if(get_qs_var('editmode') eq 'true'   &&   get_qs_var('editid') =~ /^(\d+)$/)
		{
			$editmode = 1;
			$row_id_to_edit = $1;
		}
		elsif(!$createmode)
		{
			$$extra_columns{edit} = { position => 1 };
			$$viewer_value_transforms{edit} = qq`%%variable%% = '<a href="$PREF{REQ_URI_SANS_QS}?$qs&editmode=true&amp;editid=%%id%%&amp;format=vert">$TEXT{Edit}</a>';`;
		}
	}
	$PREF{db_editor_mode} = $createmode ? 'create' : $editmode ? 'edit' : '';

	die_unless_sqlsafe($dbtable);
	die_unless_numeric($row_id_to_edit, '$row_id_to_edit');
	$db_update_details{record_id} = $row_id_to_edit;
	my $live_data_fingerprint = md5_hex($ENV{HTTP_HOST} . $ENV{HTTP_USER_AGENT} . join('',enc_sql_select("SELECT * FROM `$dbtable` WHERE `id` = $row_id_to_edit")));

	my $restriction = '';
	my $num_cols = 0;

	my $db_colnames = get_db_colnames($dbtable);
	$num_cols += ($db_colnames =~ tr/,//) + 1;

	# If any extra (i.e. not straight from the DB) columns were specified,
	# get or assign their positions:
	#
	my %extra_column_names = ();
	foreach my $colname (keys %$extra_columns)
	{
		my $requested_pos = $$extra_columns{$colname}{position};
		if(!$requested_pos || ($requested_pos < 1000))
		{
			my $pos = $$extra_columns{$colname}{position} =~ /^(\d+)$/ ? $1 : $num_cols;
			$pos++ while exists $extra_column_names{$pos};
			$extra_column_names{$pos} = $colname;
			$num_cols++;
		}
	}

	# Create the combined @column_list from the actual DB columns and
	# the extra columns with their specified positions:
	#
	my $j = 0;
	my @column_list = ();
	for(my $i = 1; $i <= $num_cols; $i++)
	{
		if($extra_column_names{$i})	{ push @column_list, $extra_column_names{$i};	}
		else				{ push @column_list, (split(/,/, $db_colnames))[$j++];	}
	}

	# Now go through the extra columns again, for any that requested to
	# be at the end of the table (by specifying a position >1000):
	#
	foreach my $colname (keys %$extra_columns)
	{
		my $requested_pos = $$extra_columns{$colname}{position};
		if($requested_pos >= 1000)
		{
			push @column_list, $colname;
			$num_cols++;
		}
	}

	my $column_list = join ',', @column_list;

	my $vertical = $qs =~ /(?:^|&)format=vert(?:&|$)/ || ($PREF{"${viewerprefname}_viewer_default_mode"} =~ /vertical/i && $qs !~ /(?:^|&)format=horiz(?:&|$)/);
	$vertical = 0 if $PREF{"${viewerprefname}_viewer_forced_mode"} =~ /horiz/i;
	$vertical = 1 if $PREF{"${viewerprefname}_viewer_forced_mode"} =~ /vert/i;
	my %columns = map { $_ => 1 } split(/,/, $column_list);
	my %hidden_columns = map { $_ => 1 } split(/\s*,\s*/, $hiddencols);
	my %disabled_columns = map { $_ => 1 } split(/\s*,\s*/, $disabledcols);
	my %hidden_cells = ();

	my %uncreatable_columns = map { $_ => 1 } split(/\s*,\s*/, $PREF{"${viewerprefname}_viewer_uncreatable_columns"});
	my %uneditable_columns = map { $_ => 1 } split(/\s*,\s*/, $PREF{"${viewerprefname}_viewer_uneditable_columns"});
	my %autoset_columns = %{$PREF{"${viewerprefname}_creation_autoset_columns"}} if $PREF{"${viewerprefname}_creation_autoset_columns"};
	$uneditable_columns{id} = $uncreatable_columns{id} = 1;

	$PREF{"${viewerprefname}_viewer_item_name"} = $PREF{"${viewerprefname}_viewer_item_name"} || 'record';
	$PREF{"${viewerprefname}_viewer_item_name_plural"} = $PREF{"${viewerprefname}_viewer_item_name_plural"} || $PREF{"${viewerprefname}_viewer_item_name"}.'s';
	s!%%itemname%%!$PREF{"${viewerprefname}_viewer_item_name"}!g for ($TEXT{database_create_button}, $TEXT{database_create_button_2}, $TEXT{database_delete_successful}, $TEXT{database_deleter_title}, $TEXT{database_deleter_checkbox}, $TEXT{database_deleter_button});


	# Set any viewer/editor options that apply to all modes (view/create/edit):
	#
	foreach my $column (split(/,/, $column_list))
	{
		my $fieldtype_already_set = 0;
		if(my ($fieldtype,$label,$listitems,$defaultvalue) = field_structure_managed_by_us($column))
		{
			$custom_titles{$column} = $label if $label;
			$PREF{"${viewerprefname}_creation_default_value"}{lc($column)} = $defaultvalue if $defaultvalue;
			if($fieldtype eq 'dropdown')
			{
				$listitems =~ s!\n!\|\|\|!g; # our field structure manager uses newline as separator; this function uses "|||".
				$PREF{"${viewerprefname}_viewer_column_is_predefined_list"}{lc($column)} = $listitems;
				$fieldtype_already_set = 1;
			}
			elsif($fieldtype eq 'checkbox')
			{
				$PREF{"${viewerprefname}_viewer_column_is_checkbox"}{lc($column)} = 1;
				$fieldtype_already_set = 1;
			}
			elsif($fieldtype eq 'radio')
			{
				$listitems =~ s!\n!\|\|\|!g; # our field structure manager uses newline as separator; this function uses "|||".
				$PREF{"${viewerprefname}_viewer_column_is_radio_buttons"}{lc($column)} = $listitems;
				$fieldtype_already_set = 1;
			}
			elsif($fieldtype eq 'freeformmulti')
			{
				$PREF{"${viewerprefname}_viewer_force_textarea"}{lc($column)} = 1;
				$fieldtype_already_set = 1;
			}
		}
		if(datatype_is_bool($dbtable,$column) && !$fieldtype_already_set)
		{
			$PREF{"${viewerprefname}_viewer_column_is_toggle"}{lc($column)} = 1;
			$fieldtype_already_set = 1;
		}
	}


	# Note: early return.
	if($ENV{REQUEST_METHOD} =~ /post/i)
	{
		my $return_url_base = param('enc_post_return_url') || $PREF{REQ_URI_SANS_QS};
		
		my $wholequery = new CGI();
		my %allparams = $wholequery->Vars;
		my %multiboxes = ();
		foreach my $param(sort keys %allparams)
		{
			if(my ($col,$val) = ($param =~ /^encdb_multibox_col_(.+)_val_(.+)/))
			{
				enc_urldecode($val);
				$multiboxes{$col} .= $val . '|||';
			}
		}
		foreach my $col (keys %multiboxes) { $multiboxes{$col} =~ s!\|\|\|$!!; } # strip the final trailing '|||'.

		if(param('searchmode') eq 'true')
		{
			exit_with_needprivs() unless $PREF{"${viewerprefname}_allowed_to_search"};

			my $redirect_url = get_return_url_for_dbviewer($return_url_base, $viewerprefname) . '&';

			my $searchquery = new CGI(); # must happen if we were POSTed to, or there's a weird delay between client/server after the script finishes.
			my %params = $searchquery->Vars;
			foreach my $param(sort keys %params)
			{
				#print "$param: $params{$param}<br />\n";
				if(my ($field) = ($param =~ /^srch_(.+)/))
				{
					my $value = $params{$param};
					my $srchmode = $params{"srchmode_${field}"};
					$redirect_url =~ s!srch[1234]_${field}=[^&]+!!g; # remove any previous values for this field from the url.
					$redirect_url .= "srch${srchmode}_${field}=$value&" unless $srchmode == 4;   # 4 means ignore-this-field.
				}
			}

			defooify('&', $redirect_url);
			enc_redirect($redirect_url);		
		}
		elsif($editmode)
		{
			exit_with_needprivs() unless $allowed_to_edit;

			my $data_fingerprint_before_editing = param('enc_form_dfp');
			exit_with_error(qq`Error: data fingerprint mismatch; the data changed while you were editing it.&nbsp; Go back, reload the page, and try again.`) unless $live_data_fingerprint eq $data_fingerprint_before_editing;

			# We're only dealing with a single row here, but we'll use _multi to get the named fields into a hash.
			my $existingdata = enc_sql_select_multi("SELECT * FROM `$dbtable` WHERE `id` = $row_id_to_edit $editmode_restrictions");

			if($qs =~ /editdelete=true/)
			{
				exit_with_needprivs() unless $allowed_to_delete;

				$db_update_details{action} = 'delete'; $db_update_details{action_pasttense} = 'deleted';

				foreach my $col (keys %{$$existingdata{1}})
				{
					exit_with_error("Error: this record cannot be deleted.") if exists $PREF{"${viewerprefname}_viewer_undeletable_rows"}{lc($col)}{   $$existingdata{1}{$col}   };
				}

				if(param('confirmdeleterecord') =~ /on/i)
				{
					my $values = enc_sql_select_multi("SELECT * FROM `$dbtable` WHERE `id` = $row_id_to_edit LIMIT 1");
					enc_sql_delete("DELETE FROM `$dbtable` WHERE `id` = $row_id_to_edit LIMIT 1");

					if(my $code = $PREF{"${viewerprefname}_deletion_oncomplete_code"})
					{
						$code =~ s/%%(\w+)%%/$$values{1}{$1}/g;
						eval $code; die_nice $@ if $@;
					}

					$db_update_details{deleted_record} = $existingdata;
					send_notification_emails_for_database_update(\%db_update_details) if $PREF{"${viewerprefname}_emailalert_on_updates"} =~ /yes/i;
					enc_redirect(get_return_url_for_dbviewer($return_url_base, $viewerprefname));
				}
				else
				{
					$qs =~ s!editdelete=true!!g;
					defooify('&',$qs);
					enc_redirect($return_url_base . ($qs ? "?$qs" : ''));
				}
			}
			else
			{
				$db_update_details{action} = 'edit'; $db_update_details{action_pasttense} = 'edited';

				my %values = ();
				foreach my $column (keys %{$$existingdata{1}})
				{
					my $value = param("encdb_$column");
					$value =~ s!\r\n!\n!g;

					if(my $code = $PREF{"${viewerprefname}_POST_value_transforms"}{lc($column)})
					{
						my %values_temp = { $column => '' };
						transform_value_according_to_code($dbtable, $value, \%values_temp, $code, $column, 2, undef);
						$value = $values_temp{$column};
					}
					elsif($PREF{"${viewerprefname}_viewer_column_is_checkbox"}{lc($column)})
					{
						$value = param("encdb_" . $column) =~ /on/i ? 1 : 0;
					}
					elsif($PREF{"${viewerprefname}_viewer_column_is_multibox"}{lc($column)})
					{
						$value = $multiboxes{$column};
					}

					replace_nonsqlsafe_chars_with($PREF{"${viewerprefname}_replace_nonsqlsafe_chars_with"}{$column}, $value) if exists $PREF{"${viewerprefname}_replace_nonsqlsafe_chars_with"}{$column};

					$values{$column} = $value;
				}

				# A second version of the same loop, but this time %values is full, so that 
				# verify_new_database_value() can use it, in case the caller has used the
				# _viewer_value_verifications mechanism with embedded %%foo%% variables which
				# require accessing other column values.
				#
				my $col_i = 0;
				foreach my $column (keys %values)
				{
					next if $disabled_columns{$column} || $column =~ /^enchddn_/i || $$existingdata{1}{enchddn_uneditable_cols_in_this_row} =~ /$column/i;
					next if $uneditable_columns{lc($column)};
					next if exists $PREF{"${viewerprefname}_viewer_uneditable_values"}{lc($column)}{   $$existingdata{1}{$column}   };

					my $value = $values{$column};
					verify_new_database_value($dbtable,$viewerprefname,$column,$value,$row_id_to_edit,\%values);

					sql_untaint($value,$column);
					die_unless_sqlsafe($value,$column);

					$col_i++;
					unless($value eq $$existingdata{1}{$column})
					{
						$db_update_details{changed_record}{$col_i}{column} = $column;
						$db_update_details{changed_record}{$col_i}{old_value} = $$existingdata{1}{$column};
						$db_update_details{changed_record}{$col_i}{new_value} = $value;

						$value = $value eq '' ? qq`NULL` : qq`'$value'`;
						my $success = enc_sql_update("UPDATE `$dbtable` SET `$column` = $value WHERE `id` = $row_id_to_edit");
						die_nice("SQL returned '$success' instead of '1' while updating '$column'.") unless $success == 1;
					}
				}

				if(my $code = $PREF{"${viewerprefname}_editmode_oncomplete_code"})
				{
					$code =~ s/%%(\w+)___old%%/$$existingdata{1}{$1}/g;
					$code =~ s/%%(\w+)%%/$values{$1}/g;
					eval $code; die_nice $@ if $@;
				}

				$db_update_details{whole_changed_record} = enc_sql_select_multi("SELECT * FROM `$dbtable` WHERE `id` = $row_id_to_edit");
				send_notification_emails_for_database_update(\%db_update_details) if $PREF{"${viewerprefname}_emailalert_on_updates"} =~ /yes/i;
				enc_redirect(get_return_url_for_dbviewer($return_url_base, $viewerprefname));
			}
		}
		else
		{
			exit_with_needprivs() unless $allowed_to_create;

			$db_update_details{action} = 'create'; $db_update_details{action_pasttense} = 'created';

			my @namelist = my @valuelist = ();

			# Do this twice, because we might need to interpolate a variable value from a
			# late column into an early column, which won't be set the first time through.
			#
			my %values = ();
			my %creation_autoset_columns___done = ();
			my %POST_value_transforms___done = ();
			foreach my $pass (1,2)
			{
				foreach my $column (split(/,/, $db_colnames))
				{
					my $value = '';
					if(my $code = $PREF{"${viewerprefname}_creation_autoset_columns"}{lc($column)})
					{
						# TODO: for clarity, should the $value param here be '' instead of $value?
						transform_value_according_to_code($dbtable, $value, \%values, $code, $column, $pass, \%creation_autoset_columns___done);
					}
					elsif(my $code = $PREF{"${viewerprefname}_POST_value_transforms"}{lc($column)})
					{
						$value = param("encdb_" . $column);
						transform_value_according_to_code($dbtable, $value, \%values, $code, $column, $pass, \%POST_value_transforms___done);
					}
					elsif($PREF{"${viewerprefname}_viewer_column_is_checkbox"}{lc($column)})
					{
						$values{$column} = param("encdb_" . $column) =~ /on/i ? 1 : 0;
					}
					elsif($PREF{"${viewerprefname}_viewer_column_is_multibox"}{lc($column)})
					{
						$value = $multiboxes{$column};
					}
					else
					{
						$values{$column} = param("encdb_" . $column);
					}
					$values{$column} =~ s!\r\n!\n!g;
				}
			}

			foreach my $column (keys %values)
			{
				next if $uncreatable_columns{$column};
				next if $column =~ /^enchddn_/i;
				next if $disabled_columns{$column} && !$autoset_columns{$column}; # don't allow disabled columns to be set, except via autoset values.

				my $value = $values{$column};
				replace_nonsqlsafe_chars_with($PREF{"${viewerprefname}_replace_nonsqlsafe_chars_with"}{$column}, $value) if exists $PREF{"${viewerprefname}_replace_nonsqlsafe_chars_with"}{$column};
				verify_new_database_value($dbtable,$viewerprefname,$column,$value,'',\%values);
				$values{$column} = $value; # want the sqlsafe version but not the sql_untainted version.
				sql_untaint($value);
				die_unless_sqlsafe($value);
				push @namelist, "`$column`";
				push @valuelist, "'$value'";
			}

			my $statement = "INSERT INTO `$dbtable` (" . (join ',', @namelist) . ") VALUES(" . (join ',', @valuelist) . ")";
			enc_sql_insert($statement);
			my $id = enc_sql_select("SELECT LAST_INSERT_ID() FROM `$dbtable`");
			$values{id} = $db_update_details{record_id} = $id;

			if(my $code = $PREF{"${viewerprefname}_creation_oncomplete_code"})
			{
				$code =~ s/%%(\w+)%%/$values{$1}/g;
				eval $code; die_nice $@ if $@;
			}

			$db_update_details{created_record} = enc_sql_select_multi("SELECT * FROM `$dbtable` WHERE `id` = $id");
			send_notification_emails_for_database_update(\%db_update_details) if $PREF{"${viewerprefname}_emailalert_on_updates"} =~ /yes/i;
			if(my $template = $PREF{"${viewerprefname}_creation_complete_page_template"})
			{
				$template =~ s/%%(\w+)%%/$values{$1}/g; kmsg_redirect($template);
			}
			elsif(my $redirect = $PREF{"${viewerprefname}_creation_complete_redirection_url"})
			{
				$redirect =~ s/%%(\w+)%%/$values{$1}/g; enc_redirect($redirect);
			}
			else
			{
				enc_redirect(get_return_url_for_dbviewer($return_url_base, $viewerprefname));
			}
		}
	}




	my ($toggles,$headers_horiz_string,%headers_horiz,%headers_vert,$firstcol) = ('','',undef,undef,undef,'');
	foreach my $column (split(/,/, $column_list))
	{
		next if $disabled_columns{$column} || $column =~ /^enchddn_/i;
		next if $uncreatable_columns{$column} && $createmode;
		next if $$extra_columns{$column} && $createmode;

		$firstcol = $column unless $firstcol;
		my $name = my $title = $column;
		if($$creation_title_transforms{$column} && $createmode)		{ $title = $$creation_title_transforms{$column};											}
		elsif($$editmode_title_transforms{$column} && $editmode)	{ $title = $$editmode_title_transforms{$column};											}
		elsif($$viewer_title_transforms{$column})			{ $title = $$viewer_title_transforms{$column};											}
		elsif($custom_titles{$column})					{ $title = $custom_titles{$column};											}
		else								{ $title =~ s/^(\w)/\u$1/; $title =~ s/_/ /g unless $PREF{dont_convert_underscores_to_spaces_in_db_titles} =~ /yes/i;	}
		my $strike = qq`style="text-decoration: line-through;"` if $hidden_columns{$name};
		$toggles .= qq`<a href="#" onclick="toggle_column('col_$name'); return false" id="link-col_$name" $strike>$title</a>&nbsp; `;

		$hidden_cells{$name} = qq`style="display: none;"` if $hidden_columns{$name} && !$createmode; # don't hide them in createmode, where the user must be able to see them to enter values for them.

		my $new_qs = $qs;
		#$new_qs =~ s/(^|&)$qs_id(&|$)/$1$2/g;
		$new_qs =~ s/(^|&)sort=\w+?(&|$)/$1$2/g;
		$new_qs =~ s/(^|&)reverse=\d(&|$)/$1$2/g;
		$new_qs =~ s/(^|&)phase=\w+?(&|$)/$1$2/g;
		$new_qs .= "&sort=$name";
		if($qs =~ /(?:^|&)reverse=1(?:&|$)/) { $new_qs .= "&reverse=0"; } else { $new_qs .= "&reverse=1"; }
		defooify('&',$new_qs);
		$new_qs =~ s/&/&amp;/g;

		my $style_horiz = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_horiz"}{"${column}_header"} . qq`"`) if exists $PREF{"${viewerprefname}_viewer_style_horiz"}{"${column}_header"};
		my $style_vert  = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_vert"}{"${column}_header"} . qq`"`)  if exists $PREF{"${viewerprefname}_viewer_style_vert"}{"${column}_header"};
		#my $link = $self =~ /\?/ ? "$self&$new_qs" : "$self?$new_qs";
		my $link = "$PREF{REQ_URI_SANS_QS}?$new_qs";
		$headers_horiz_string	.= qq`<th class="col_$name" $hidden_cells{$name} $style_horiz><a href="$link">$title</a></th>`;
		$headers_horiz{$name}	 = qq`<th class="col_$name" $hidden_cells{$name} $style_horiz><a href="$link">$title</a></th>`;
		$headers_vert{$name}	 = qq`<td class="col_$name verthead" $hidden_cells{$name} $style_vert><a href="$link">$title</a><span class="header_input_notes">` . ($createmode || $editmode ? $PREF{"${viewerprefname}_input_notes_for_vertmode_col_header"}{$column} : '') . qq`</span></td>`;
	}

	my $output = '';
	my $there_were_some_results = 0;

	if($createmode)
	{
		my $createclass = $vertical ? 'enc_dbcreate_tbl_vert' : 'enc_dbcreate_tbl_horiz';
		$output .= qq`<form method="post" action="$ENV{SCRIPT_NAME}?$qs" style="margin: 0; padding: 0;">\n`;
		$output .= qq`<div id="${dbtable}_table" class="enc_tbl enc_db_tbl enc_create_tbl $createclass">\n<table>\n`;
		$output .= qq`<tr class="headers">$headers_horiz_string</tr>\n` unless $vertical;

		my $i = 0;
		my $numcols = 1;
		my $oddeven = oddeven($i);
		$output .= qq`<tr class="$oddeven">` unless $vertical;
		foreach my $column (split(/,/, $column_list))
		{
			next if $disabled_columns{$column} || $column =~ /^enchddn_/i;
			next if $uncreatable_columns{$column};
			next if $$extra_columns{$column};
			next if $autoset_columns{$column};

			my $value = '';
			if(my $default = $PREF{"${viewerprefname}_creation_default_value"}{lc($column)})
			{
				if($default eq 'preset:date8')		{ $value = strftime("%Y%m%d",localtime(offsettime())); }
				elsif($default eq 'preset:date17')	{ $value = strftime("%Y%m%d-%H:%M:%S",localtime(offsettime())); }
				elsif($default eq 'preset:etime')	{ $value = offsettime(); }
				elsif($default =~ /%URL\{\w+\}/)	{ interpolate_vars_from_URL_and_cookies($default); $value = $default; }
				else					{ $value = $default; }
			}

			#my $readonly = $uneditable_columns{lc($column)};
			my $readonly = '';

			my ($readonly__still_submitted, $readonly__still_submitted__class) = ('readonly="readonly"', 'db_readonly') if $PREF{"${viewerprefname}_readonly_value__still_submitted"}{lc($column)};


			# Process viewer/editor options:
			#
			if($PREF{"${viewerprefname}_viewer_column_is_checkbox"}{lc($column)} && !$readonly)
			{
				$value = qq`<input type="checkbox" name="encdb_$column" ` . ($value ? qq`checked="checked"` : '') . qq` />`;
			}
			elsif(exists $PREF{"${viewerprefname}_viewer_column_is_toggle"}{lc($column)} && !$readonly)
			{
				my ($yes,$no) = $PREF{"${viewerprefname}_viewer_column_toggle_values"}{lc($column)} =~ /(.+)\|(.+)/ ? ($1,$2) : ($TEXT{boolean_true_string}, $TEXT{boolean_false_string});
				$value  = qq`<select name="encdb_$column">`
					. qq`<option value="1"` . ($value  ? ' selected="selected"' : '') . qq`>$yes</option>`
					. qq`<option value="0"` . (!$value ? ' selected="selected"' : '') . qq`>$no</option>`
					. qq`</selected>`;
			}
			elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_predefined_list"}{lc($column)})
			{
				my $dropdown = qq`<select name="encdb_$column">`;
				my $value_is_in_list = 0;
				foreach my $item (split(/\s*\|\|\|\s*/, $list))
				{
					my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
					my $selected = '';
					if($submitted_value eq $value)
					{
						$selected = 'selected="selected"';
						$value_is_in_list = 1;
					}
					$dropdown .= qq`<option value="$submitted_value" $selected>$displayed_value</option>`;
				}
				$dropdown .= qq`<option selected="selected" value="$value">$value (error: not in list!)</option>` if !$value_is_in_list && $value;
				$dropdown .= qq`</select>`;
				$value = $dropdown;
			}
			elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_multibox"}{lc($column)})
			{
				my %allvalues = map { $_ => 1 } split(/\|\|\|/, $value);
				my @boxes = ();
				my $value_is_in_list = 0;
				foreach my $item (split(/\s*\|\|\|\s*/, $list))
				{
					my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
					my $checked = '';
					if($allvalues{$submitted_value})
					{
						$checked = 'checked="checked"';
						$value_is_in_list = 1;
					}
					my $submitted_value_for_paramname = enc_urlencode_return($submitted_value);
					my $boxid = "encdb_multibox_col_${column}_val_${submitted_value_for_paramname}";
					push @boxes, qq`<input type="checkbox" name="$boxid" id="$boxid" $checked /><label for="$boxid">$displayed_value</label>`;
				}
				push @boxes, qq`$value (error: not in list!)` if !$value_is_in_list && $value;
				my $separator = $PREF{"db_viewer_multibox_separator___$column"} || $PREF{db_viewer_multibox_separator___global} || '<br />';
				$value = join $separator, @boxes;
			}
			elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_radio_buttons"}{lc($column)})
			{
				my $item_i = 1;
				my @buttons = ();
				my $value_is_in_list = 0;
				foreach my $item (split(/\s*\|\|\|\s*/, $list))
				{
					my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
					my $checked = '';
					if($submitted_value eq $value)
					{
						$checked = 'checked="checked"';
						$value_is_in_list = 1;
					}
					push @buttons, qq`<input type="radio" name="encdb_$column" id="encdb_radio_${column}_${item_i}" value="$submitted_value" $checked /><label for="encdb_radio_${column}_${item_i}">$displayed_value</label>`;
					$item_i++;
				}
				my $separator = $PREF{"db_viewer_radiobutton_separator___$column"} || $PREF{db_viewer_radiobutton_separator___global} || '<br />';
				$value = join $separator, @buttons;
			}
			elsif(my $query = $PREF{"${viewerprefname}_creation_dropdown_from_SQL"}{lc($column)})
			{
				# The value of this query pref must start with: SELECT foo,bar FROM [...].
				# The first column will be the submitted value and the second the displayed value.

				my ($col1,$col2) = ($query =~ /^SELECT (\w+),(\w+) FROM /);
				my $dropdown = qq`<select name="encdb_$column">`;
				my $value_is_in_list = 0;
				my $results = enc_sql_select_multi($query);
				foreach my $k (sort { $a <=> $b } keys %$results)
				{
					my $submitted_value = $$results{$k}{$col1};
					my $displayed_value = $$results{$k}{$col2};
					my $selected = '';
					if($submitted_value eq $value)
					{
						$selected = 'selected="selected"';
						$value_is_in_list = 1;
					}
					$dropdown .= qq`<option value="$submitted_value" $selected>$displayed_value</option>`;
				}
				$dropdown .= qq`<option selected="selected" value="$value">$value (error: not in list!)</option>` if !$value_is_in_list && $value;
				$dropdown .= qq`</select>`;
				$value = $dropdown;
			}
			elsif(my $folder = $PREF{"${viewerprefname}_file_list"}{lc($column)})
			{
				my @files = get_all_files($folder);
				my $dropdown = qq`<select name="encdb_$column"><option selected="selected" value=""></option>`;
				foreach my $file (@files)
				{
					$dropdown .= qq`<option value="$file">$file</option>`;
				}
				$dropdown .= qq`</select>`;
				$value = $dropdown;
			}
			elsif(exists $PREF{"${viewerprefname}_image_picker"}{lc($column)})
			{
				my $image_picker = \%{$PREF{"${viewerprefname}_image_picker"}{lc($column)}};
				my $link_url = $$image_picker{link_url};
				my $thumb_url = $$image_picker{thumb_url};
				my @filenames = split(/\|\|\|/, $$image_picker{filenames});
				$value  = qq`<div class="encdb_imgpkr_wrapper">\n<div class="encdb_imgpkr_chosen_label">$TEXT{database_image_picker_chosen_images_label}</div>\n<div class="encdb_imgpkr_chosen" id="encdb_imgpkr_chosen_$column"><div class="empty_placeholder">$TEXT{database_image_picker_no_images_label}</div></div>\n`;
				$value .= qq`<div class="encdb_imgpkr_all_label">$TEXT{database_image_picker_available_images_label}</div>\n<div class="encdb_imgpkr_all" id="encdb_imgpkr_all_$column">\n`;
				foreach my $image (@filenames)
				{
					my $css_id = $image; $css_id =~ s!\W!_!g;
					$value .= qq`<div class="encdb_imgpkr_image_block" id="encdb_imgpkr_image_${column}_${css_id}">`
						. qq`<div class="imgpkr_thumb"><a href="$link_url/$image"><img src="$thumb_url/$image" /></a></div>`
						. qq`<div class="imgpkr_text">$image<br /><a href="#" class="encdb_imgpkr_actionlink" onclick="encdb_imgpkr_choose('$column','$image','$css_id'); return false" />$TEXT{database_image_picker_choose_button}</a></div>`
						. qq`</div>\n`;
				}
				$value .= qq`<input type="hidden" name="encdb_$column" id="encdb_$column" class="text" />\n`;
				$value .= qq`</div>\n`;
			}
			else
			{
				my $textlength = 'longtext';
				my $force_textarea = $PREF{"${viewerprefname}_viewer_force_textarea"}{lc($column)};

				$value = $readonly
					? qq`<div class="readonly">$value</div>`
					: (length($value) > 50 || $force_textarea)
					? qq`<textarea name="encdb_$column" class="text $textlength $readonly__still_submitted__class" $readonly__still_submitted>$value</textarea>`
					: qq`<input type="text" name="encdb_$column" class="text $readonly__still_submitted__class" value="$value" $readonly__still_submitted />`;
			}

			my $style_horiz = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_horiz"}{$column} . qq`"`) if exists $PREF{"${viewerprefname}_viewer_style_horiz"}{$column};
			my $style_vert  = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_vert"}{$column} . qq`"`)  if exists $PREF{"${viewerprefname}_viewer_style_vert"}{$column};
			my $style = $vertical ? $style_vert : $style_horiz;
			my $vertclass = 'vertcell' if $vertical;
			$output .= qq`<tr class="$oddeven vertrow">` if $vertical;
			$output .= $headers_vert{$column} if $vertical;
			$output .= qq`<td class="col_$column $vertclass" $hidden_cells{$column} $style>$value</td>`;
			$output .= qq`</tr>\n` if $vertical;
			$numcols++;
		}
		$output .= qq`</tr>\n` unless $vertical;

		$output .= qq`<tr class="` . oddeven($i) . qq`">`;
		$output .= qq`<td colspan="$numcols" class="button"><input type="submit" class="button" value="$TEXT{database_create_button_2}" /></td>`;
		$output .= qq`</tr>\n`;

		$output .= qq`</table>\n</div>\n`;
		$output .= qq`<input type="hidden" name="enc_post_return_url" value="$PREF{REQ_URI_SANS_QS}" />\n`;
		$output .= qq`</form>\n`;
	}
	else
	{
		my $tblclass = '';
		if($editmode)	{ $tblclass = $vertical ? ' enc_dbedit_tbl_vert' : ' enc_dbedit_tbl_horiz'; $tblclass .= ' enc_edit_tbl'; }
		else		{ $tblclass = $vertical ? ' enc_dbview_tbl_vert' : ' enc_dbview_tbl_horiz'; }
		my $quicksort_class = quicksort_is_active() ? 'enc_sortable' : '';
		$output .= qq`<form method="post" action="$ENV{SCRIPT_NAME}?$qs" style="margin: 0; padding: 0;">\n` if $editmode;
		$output .= qq`<div id="columntoggles">Show/hide:&nbsp; $toggles</div>\n` unless $PREF{"${viewerprefname}_viewer_hide_column_toggles"} =~ /yes/i;
		$output .= qq`<div id="${dbtable}_table" class="enc_tbl enc_db_tbl $tblclass">\n<table class="$quicksort_class" id="db_viewer_table">\n` unless $vertical;
		$output .= qq`<tr class="headers">$headers_horiz_string</tr>\n` unless $vertical;

		# 20090429: changed the query from this:
		#
		#	SELECT * FROM `$dbtable` LIMIT $sql_range_start, $range_end
		#
		# ...to this:
		#
		#	SELECT * FROM `$dbtable` $DESC LIMIT $sql_range_start, $range_end
		#
		# ...where $DESC = $reverse ? 'ORDER BY `id` DESC' : ''.
		# This is so that, when sorting in reverse with multiple pages of records (with
		# for example 25 records per page), page #1 shows the *last* 25 records, rather
		# than the first 25 but in reverse order.  But, shouldn't we be using $sortkey,
		# as in the original now-commented-out query, rather than hard-coding it to `id`?

		my $sortkey = $qs =~ /(?:^|&)sort=(\w+?)(?:&|$)/ ? $1
			: $PREF{"${viewerprefname}_viewer_default_sort_field"} ? $PREF{"${viewerprefname}_viewer_default_sort_field"} 
			: exists $columns{id} ? 'id'
			: $firstcol;
		my $reverse = $qs =~ /(?:^|&)reverse=1(?:&|$)/ ? 1 : 0; # toggle the 1s and 0s to reverse by default or not.
		#my $DESC = $reverse ? 'ORDER BY `id` DESC' : '';
		my $DESC = $reverse ? 'DESC' : '';
		enc_urldecode($sortkey);
		die_unless_sqlsafe($sortkey);

		# 20110823: moving the querystring-based result restriction logic up here, so we can
		# make it part of the actual SQL query, and thus have the result count and pagination
		# numbers etc be correct, as opposed to before when this was done just after the SQL
		# query by simply hiding (skipping) result rows that didn't match the qs-specified
		# restrictions.
		#
		foreach my $column (split(/,/, $column_list))
		{
			if($qs =~ /(?:^|&)$column=([^&]*)(?:&|$)/i)
			{
				my $url_specified_value = $1;
				enc_urldecode($url_specified_value);
				sql_untaint($url_specified_value);
				die_unless_sqlsafe($url_specified_value);
				$selection_restrictions .= $selection_restrictions ? " AND " : " WHERE ";
				$selection_restrictions .= "`$column` = '$url_specified_value'";
			}
		}

		while($qs =~ /(?:^|&)srch([123])_([^=]+)=([^&]+)/g)
		{
			my ($srchmode, $srchfield, $srchvalue) = ($1, $2, $3);
			$srchvalue = enc_urldecode_return($srchvalue);
			sql_untaint($srchfield,$srchvalue);
			die_unless_sqlsafe($srchfield,$srchvalue);
			$selection_restrictions .= $selection_restrictions ? " AND " : " WHERE ";
			if($srchmode == 1) # exact.
			{
				$selection_restrictions .= "`$srchfield` = '$srchvalue'";
			}
			elsif($srchmode == 2) # partial.
			{
				$selection_restrictions .= "`$srchfield` LIKE '%$srchvalue%'";
			}
			elsif($srchmode == 3) # invert.
			{
				$selection_restrictions .= "`$srchfield` NOT LIKE '%$srchvalue%'";
			}
		}
		
		#my $rows = enc_sql_select_multi("SELECT * FROM `$dbtable` ORDER BY `$sortkey` LIMIT $sql_range_start, $range_end");
		my $mainquery = "SELECT * FROM `$dbtable` $selection_restrictions ORDER BY `$sortkey` $DESC LIMIT $sql_range_start, $itemsperpage";
		#encdebug "query: $mainquery";
		my $rows = enc_sql_select_multi($mainquery);

		# Do a first pass so we can perform value_transforms, so the values are
		# set and then we can do the sorting properly in the second pass.
		#
		foreach my $row (keys %$rows)
		{
			# Actually, do this first pass twice, because we might need to interpolate
			# a variable value from a late column into an early column, which won't be
			# set the first time through.
			#
			my %already_transformed = ();
			foreach my $pass (1,2)
			{
				foreach my $column (split(/,/, $column_list))
				{
					#next if $disabled_columns{$column}; # actually, don't skip disabled cols here; we want their values to be available for transforms for other cols.
					my $value = exists $$extra_columns{$column} ? $$extra_columns{$column}{value} : $$rows{$row}{$column};
					$$rows{$row}{"${column}___raw"} = $value if $pass==1;
					if((my $code = $$viewer_value_transforms{$column})   &&   $qs !~ /(^|&)raw$column=yes(&|$)/i)
					{
						transform_value_according_to_code($dbtable, $value, \%{$$rows{$row}}, $code, $column, $pass, \%already_transformed);
					}
					elsif((my $code = $PREF{"${viewerprefname}_editmode_frontend_value_transforms"}{lc($column)})   &&   $qs !~ /(^|&)raw$column=yes(&|$)/i)
					{
						transform_value_according_to_code($dbtable, $value, \%{$$rows{$row}}, $code, $column, $pass, \%already_transformed);
					}
					else
					{
						$$rows{$row}{$column} = $value;
					}
				}
			}
		}

		my $there_was_some_output = 0;
		my $numcols = 0;
		my $i = 1;
		foreach my $row (sort
		{
			  $$rows{$a}{$sortkey} =~ /^\d*$/ && $$rows{$b}{$sortkey} =~ /^\d*$/ && $reverse	? lc($$rows{$b}{$sortkey}) <=> lc($$rows{$a}{$sortkey})
			: $$rows{$a}{$sortkey} =~ /^\d*$/ && $$rows{$b}{$sortkey} =~ /^\d*$/			? lc($$rows{$a}{$sortkey}) <=> lc($$rows{$b}{$sortkey})
			: $reverse										? lc($$rows{$b}{$sortkey}) cmp lc($$rows{$a}{$sortkey})
			: 											  lc($$rows{$a}{$sortkey}) cmp lc($$rows{$b}{$sortkey})
		}
		keys %$rows)
		{
			my $failed_to_match_url_spec = my $row_is_hidden_via_value_regex = 0;
			foreach my $column (split(/,/, $column_list))
			{
				# 20110823: moved to above the SQL query.
				#
				#if($qs =~ /(?:^|&)$column=([^&]*)(?:&|$)/i)
				#{
				#	my $url_specified_value = $1;
				#	enc_urldecode($url_specified_value);
				#	$failed_to_match_url_spec = 1 if $$rows{$row}{$column} ne $url_specified_value;
				#}

				if(exists $PREF{"${viewerprefname}_viewer_hidden_values_regex"}{lc($column)} && $qs !~ /showhiddenrows=true/)
				{
					my $regex = $PREF{"${viewerprefname}_viewer_hidden_values_regex"}{lc($column)};
					$row_is_hidden_via_value_regex ||= $regex && $$rows{$row}{$column} =~ /($regex)/i;
				}
			}
			next if $failed_to_match_url_spec || $row_is_hidden_via_value_regex;

			next if $editmode && $$rows{$row}{id} != $row_id_to_edit;

			$numcols = 0;
			my $oddeven = oddeven($i);
			$output .= qq`<div id="${dbtable}_table" class="enc_tbl enc_db_tbl $tblclass">\n<table>\n` if $vertical;
			$output .= qq`<tr class="$oddeven">` unless $vertical;
			foreach my $column (split(/,/, $column_list))
			{
				next if $disabled_columns{$column} || $column =~ /^enchddn_/i;
				my $value = '';

				if($editmode)
				{
					$value = $$rows{$row}{"${column}___raw"};
					my $transformed_value = $$rows{$row}{$column};

					# If *any* of the columns in this row are specified in _viewer_undeletable_rows,
					# then the whole row must be undeletable, so disable the $allowed_to_delete bit.
					#
					$allowed_to_delete = 0 if exists $PREF{"${viewerprefname}_viewer_undeletable_rows"}{lc($column)}{$value};
					#
					# Or if the table has an "enchddn_undeletable" column, and it's enabled for this
					# row, then disable the $allowed_to_delete bit.
					#
					$allowed_to_delete = 0 if $$rows{$row}{enchddn_undeletable};

					my $uneditable_value = exists $PREF{"${viewerprefname}_viewer_uneditable_values"}{lc($column)}{$value};
					my $readonly = $$extra_columns{lc($column)} || $uneditable_columns{lc($column)} || $uneditable_value;
					$readonly = 1 if $value ne $transformed_value && exists $PREF{"${viewerprefname}_viewer_readonly_if_transformed"}{lc($column)};
					$readonly = 1 if exists $$rows{$row}{enchddn_uneditable_cols_in_this_row} && $$rows{$row}{enchddn_uneditable_cols_in_this_row} =~ /$column/i;

					if($PREF{"${viewerprefname}_viewer_column_is_checkbox"}{lc($column)} && !$readonly)
					{
						$value = qq`<input type="checkbox" name="encdb_$column" ` . ($value ? qq`checked="checked"` : '') . qq` />`;
					}
					elsif(exists $PREF{"${viewerprefname}_viewer_column_is_toggle"}{lc($column)} && !$readonly)
					{
						my ($yes,$no) = $PREF{"${viewerprefname}_viewer_column_toggle_values"}{lc($column)} =~ /(.+)\|(.+)/ ? ($1,$2) : ($TEXT{boolean_true_string}, $TEXT{boolean_false_string});
						if($transformed_value =~ /^[01]?$/)
						{
							$value  = qq`<select name="encdb_$column">`
								. qq`<option value="1"` . ($value  ? ' selected="selected"' : '') . qq`>$yes</option>`
								. qq`<option value="0"` . (!$value ? ' selected="selected"' : '') . qq`>$no</option>`
								. qq`</selected>`;
						}
						else
						{
							# So we can use a transform to set the displayed value to 'N/A' (for example)
							# if necessary, for cases where the column shouldn't apply at all based on
							# other column values for this row.
							#
							$value = $transformed_value;
						}
					}
					elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_predefined_list"}{lc($column)})
					{
						my $dropdown = qq`<select name="encdb_$column">`;
						my $value_is_in_list = 0;
						foreach my $item (split(/\s*\|\|\|\s*/, $list))
						{
							my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
							my $selected = '';
							if($submitted_value eq $value)
							{
								$selected = 'selected="selected"';
								$value_is_in_list = 1;
							}
							$dropdown .= qq`<option value="$submitted_value" $selected>$displayed_value</option>`;
						}
						$dropdown .= qq`<option selected="selected" value="$value">$value (error: not in list!)</option>` if !$value_is_in_list && $value;
						$dropdown .= qq`</select>`;
						$value = $dropdown;
					}
					elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_multibox"}{lc($column)})
					{
						my %allvalues = map { $_ => 1 } split(/\|\|\|/, $value);
						my @boxes = ();
						my $value_is_in_list = 0;
						foreach my $item (split(/\s*\|\|\|\s*/, $list))
						{
							my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
							my $checked = '';
							if($allvalues{$submitted_value})
							{
								$checked = 'checked="checked"';
								$value_is_in_list = 1;
							}
							my $submitted_value_for_paramname = enc_urlencode_return($submitted_value);
							my $boxid = "encdb_multibox_col_${column}_val_${submitted_value_for_paramname}";
							push @boxes, qq`<input type="checkbox" name="$boxid" id="$boxid" $checked /><label for="$boxid">$displayed_value</label>`;
						}
						push @boxes, qq`$value (error: not in list!)` if !$value_is_in_list && $value;
						my $separator = $PREF{"db_viewer_multibox_separator___$column"} || $PREF{db_viewer_multibox_separator___global} || '<br />';
						$value = join $separator, @boxes;
					}
					elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_radio_buttons"}{lc($column)})
					{
						my $item_i = 1;
						my @buttons = ();
						my $value_is_in_list = 0;
						foreach my $item (split(/\s*\|\|\|\s*/, $list))
						{
							my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
							my $checked = '';
							if($submitted_value eq $value)
							{
								$checked = 'checked="checked"';
								$value_is_in_list = 1;
							}
							push @buttons, qq`<input type="radio" name="encdb_$column" id="encdb_radio_${column}_${item_i}" value="$submitted_value" $checked /><label for="encdb_radio_${column}_${item_i}">$displayed_value</label>`;
							$item_i++;
						}
						my $separator = $PREF{"db_viewer_radiobutton_separator___$column"} || $PREF{db_viewer_radiobutton_separator___global} || '<br />';
						$value = join $separator, @buttons;
					}
					elsif(my $query = $PREF{"${viewerprefname}_editmode_dropdown_from_SQL"}{lc($column)})
					{
						# The value of this query pref must start with: SELECT foo,bar FROM [...].
						# The first column will be the submitted value and the second the displayed value.

						my ($col1,$col2) = ($query =~ /^SELECT (\w+),(\w+) FROM /);
						my $dropdown = qq`<select name="encdb_$column">`;
						my $value_is_in_list = 0;
						my $results = enc_sql_select_multi($query);
						foreach my $k (sort { $a <=> $b } keys %$results)
						{
							my $submitted_value = $$results{$k}{$col1};
							my $displayed_value = $$results{$k}{$col2};
							my $selected = '';
							if($submitted_value eq $value)
							{
								$selected = 'selected="selected"';
								$value_is_in_list = 1;
							}
							$dropdown .= qq`<option value="$submitted_value" $selected>$displayed_value</option>`;
						}
						$dropdown .= qq`<option selected="selected" value="$value">$value (error: not in list!)</option>` if !$value_is_in_list && $value;
						$dropdown .= qq`</select>`;
						$value = $dropdown;
					}
					elsif(my $folder = $PREF{"${viewerprefname}_file_list"}{lc($column)})
					{
						my @files = get_all_files($folder);
						my $dropdown = qq`<select name="encdb_$column">`;
						my $value_is_in_list = 0;
						foreach my $file (@files)
						{
							my $selected = '';
							if($file eq $value)
							{
								$selected = 'selected="selected"';
								$value_is_in_list = 1;
							}
							$dropdown .= qq`<option value="$file" $selected>$file</option>`;
						}
						$dropdown .= qq`<option selected="selected" value="$value">$value (error: file does not exist!)</option>` if !$value_is_in_list && $value;
						$dropdown .= qq`</select>`;
						$value = $dropdown;
					}
					elsif(exists $PREF{"${viewerprefname}_image_picker"}{lc($column)})
					{
						my $image_picker = \%{$PREF{"${viewerprefname}_image_picker"}{lc($column)}};
						my $link_url = $$image_picker{link_url};
						my $thumb_url = $$image_picker{thumb_url};
						my $dbvalue = $value;
						my @chosen_filenames = split(/:::::/, $dbvalue);
						my @filenames = split(/\|\|\|/, $$image_picker{filenames});
						$value  = qq`<div class="encdb_imgpkr_wrapper">\n<div class="encdb_imgpkr_chosen_label">$TEXT{database_image_picker_chosen_images_label}</div>\n<div class="encdb_imgpkr_chosen" id="encdb_imgpkr_chosen_$column">`;
						if(@chosen_filenames)
						{
							foreach my $image (@chosen_filenames)
							{
								my $css_id = $image; $css_id =~ s!\W!_!g;
								$value .= qq`<div class="encdb_imgpkr_image_block" id="encdb_imgpkr_image_chosen_${column}_${css_id}">`
									. qq`<div class="imgpkr_thumb"><a href="$link_url/$image"><img src="$thumb_url/$image" /></a></div>`
									. qq`<div class="imgpkr_text">$image<br /><a href="#" class="encdb_imgpkr_actionlink" onclick="encdb_imgpkr_unchoose('$column','$image','$css_id'); return false" />$TEXT{database_image_picker_remove_button}</a></div>`
									. qq`</div>\n`;
							}
						}
						else
						{
							$value .= qq`<div class="empty_placeholder">$TEXT{database_image_picker_no_images_label}</div>`;
						}
						$value .= qq`</div>\n`;
						$value .= qq`<div class="encdb_imgpkr_all_label">$TEXT{database_image_picker_available_images_label}</div>\n<div class="encdb_imgpkr_all" id="encdb_imgpkr_all_$column">\n`;
						foreach my $image (@filenames)
						{
							my $css_id = $image; $css_id =~ s!\W!_!g;
							$value .= qq`<div class="encdb_imgpkr_image_block" id="encdb_imgpkr_image_${column}_${css_id}">`
								. qq`<div class="imgpkr_thumb"><a href="$link_url/$image"><img src="$thumb_url/$image" /></a></div>`
								. qq`<div class="imgpkr_text">$image<br /><a href="#" class="encdb_imgpkr_actionlink" onclick="encdb_imgpkr_choose('$column','$image','$css_id'); return false" />$TEXT{database_image_picker_choose_button}</a></div>`
								. qq`</div>\n`;
						}
						$value .= qq`<input type="hidden" name="encdb_$column" id="encdb_$column" class="text" value="$dbvalue" />\n`;
						$value .= qq`</div>\n`;
					}
					else
					{
						$value = $transformed_value if $readonly; # display the transformed value, instead of the raw value, if it's not editable.
						$value = $transformed_value if $PREF{"${viewerprefname}_editmode_frontend_value_transforms"}{lc($column)};

						$value =~ s!"!&quot;!g unless $readonly;
						my $textlength = length($value) < 50 ? 'shorttext' : length($value) < 200 ? 'mediumtext' : 'longtext';
						my $force_textarea = $PREF{"${viewerprefname}_viewer_force_textarea"}{lc($column)};

						if(!$value && exists $PREF{"${viewerprefname}_viewer_display_value_if_null"}{lc($column)})
						{
							$value = $PREF{"${viewerprefname}_viewer_display_value_if_null"}{lc($column)};
						}

						$value = $readonly
							? qq`<div class="readonly">$value</div>`
							: (length($value) > 50 || $force_textarea)
							? qq`<textarea name="encdb_$column" class="text $textlength">$value</textarea>`
							: qq`<input type="text" name="encdb_$column" class="text" value="$value" />`;
					}
				}
				else
				{
					$value = $$rows{$row}{$column};

					# Value processing:
					#
					if($PREF{"${viewerprefname}_viewer_column_is_checkbox"}{lc($column)})
					{
						$value = $value ? $TEXT{boolean_true_string} : $TEXT{boolean_false_string};
					}
					elsif($PREF{"${viewerprefname}_viewer_column_is_toggle"}{lc($column)})
					{
						my ($yes,$no) = $PREF{"${viewerprefname}_viewer_column_toggle_values"}{lc($column)} =~ /(.+)\|(.+)/ ? ($1,$2) : ($TEXT{boolean_true_string}, $TEXT{boolean_false_string});
						$value = $value == 1 ? $yes : $value =~ /^0?$/ ? $no : $value;
					}
					elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_predefined_list"}{lc($column)})
					{
						foreach my $item (split(/\s*\|\|\|\s*/, $list))
						{
							my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
							$value = $displayed_value if $submitted_value eq $value;
						}
					}
					elsif(my $list = $PREF{"${viewerprefname}_viewer_column_is_multibox"}{lc($column)})
					{
						my %allvalues = map { $_ => 1 } split(/\|\|\|/, $value);
						my @boxes = ();
						foreach my $item (split(/\s*\|\|\|\s*/, $list))
						{
							my ($submitted_value, $displayed_value) = $item =~ m!(.*)///(.*)! ? ($1,$2) : ($item,$item);
							push(@boxes, $displayed_value) if $allvalues{$submitted_value};
						}
						my $sep = $PREF{"${viewerprefname}_viewer_column_multibox_separator"}{lc($column)} || '<br />';
						$value = join $sep, @boxes;
					}
					elsif(exists $PREF{"${viewerprefname}_image_picker"}{lc($column)})
					{
						my $sep = $PREF{"${viewerprefname}_image_picker_separator"}{lc($column)} || ',<br />';
						$value = join $sep, split(/:::::/, $value);
					}

					# Value correction/cleanup:
					#
					my $max_display_length = $PREF{"${viewerprefname}_viewer_percolumn_max_display_length"}{lc($column)} =~ /^(\d+)$/ ? $1 : $display_length;
					if(length($value) > $max_display_length && $value !~ m!</?\w+>!) # don't shorten values containing HTML, b/c it'll break the code.
					{
						my $abbreviated_value = $value;
						$abbreviated_value =~ s/^(.{$max_display_length}).*/$1.../;
						$value =~ s/"/\\"/g;
						$value = qq`<span title="$value">$abbreviated_value</span>`;
					}
					if(!$value && exists $PREF{"${viewerprefname}_viewer_display_value_if_null"}{lc($column)})
					{
						$value = $PREF{"${viewerprefname}_viewer_display_value_if_null"}{lc($column)};
					}
					if($PREF{"${viewerprefname}_viewer_show_HTML_as_code"}{lc($column)})
					{
						$value =~ s/</&lt;/g;
						$value =~ s/>/&gt;/g;
					}
					$value =~ s!\n!<br />\n!g;
				}

				my $style_horiz = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_horiz"}{$column} . qq`"`) if exists $PREF{"${viewerprefname}_viewer_style_horiz"}{$column};
				my $style_vert  = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_vert"}{$column} . qq`"`)  if exists $PREF{"${viewerprefname}_viewer_style_vert"}{$column};
				my $style = $vertical ? $style_vert : $style_horiz;
				my $vertclass = 'vertcell' if $vertical;
				$output .= qq`<tr class="$oddeven vertrow">` if $vertical;
				$output .= $headers_vert{$column} if $vertical;
				$output .= qq`<td class="col_$column $vertclass" $hidden_cells{$column} $style>$value</td>`;
				$output .= qq`</tr>\n` if $vertical;
				$there_was_some_output = 1;
				$numcols++;
			}

			if($vertical)
			{
				if($editmode)
				{
					$output .= qq`<tr class="` . oddeven($i) . qq`">`;
					$output .= qq`<td colspan="$numcols" class="button"><input type="hidden" name="enc_form_dfp" value="$live_data_fingerprint" /><input type="submit" class="button" value="$TEXT{database_save_button}" /></td>`;
					$output .= qq`</tr>\n`;
				}
				elsif($allowed_to_create)
				{
					$output .= qq`<tr class="` . oddeven($i) . qq` enc_sortbottom">`;
					$output .= qq`<td colspan="$numcols" class="addnew"><a href="$PREF{REQ_URI_SANS_QS}?$qs&amp;createmode=true&amp;format=vert">$TEXT{database_create_button}</a></td>`;
					$output .= qq`</tr>\n`;
				}
			}

			$output .= qq`</tr>\n` unless $vertical;
			$output .= qq`</table>\n</div>\n` if $vertical;
		}

		unless($numcols)
		{
			foreach my $column (split(/,/, $column_list))
			{
				next if $disabled_columns{$column} || $column =~ /^enchddn_/i;
				$numcols++;
			}
		}

		if(!$vertical)
		{
			if($editmode)
			{
				$output .= qq`<tr class="` . oddeven($i) . qq`">`;
				$output .= qq`<td colspan="$numcols" class="button"><input type="hidden" name="enc_form_dfp" value="$live_data_fingerprint" /><input type="submit" class="button" value="$TEXT{database_save_button}" /></td>`;
				$output .= qq`</tr>\n`;
				$there_was_some_output = 1;
			}
			elsif($allowed_to_create)
			{
				$output .= qq`<tr class="` . oddeven($i) . qq` enc_sortbottom">`;
				$output .= qq`<td colspan="$numcols" class="addnew"><a href="$PREF{REQ_URI_SANS_QS}?$qs&amp;createmode=true&amp;format=vert">$TEXT{database_create_button}</a></td>`;
				$output .= qq`</tr>\n`;
				$there_was_some_output = 1;
			}
		}

		unless($there_was_some_output)
		{
			$output .= qq`<div id="${dbtable}_table" class="enc_tbl enc_db_tbl">\n<table>\n` if $vertical;
			$output .= qq`<tr class="` . oddeven($i) . qq`">`;
			$output .= qq`<td colspan="$numcols">$TEXT{no_output_from_database}</td>`;
			$output .= qq`</tr>\n`;
			$output .= qq`</table>\n</div>\n` if $vertical;
		}

		$output .= qq`</table>\n</div>\n` unless $vertical;
		$output .= qq`<input type="hidden" name="enc_post_return_url" value="$PREF{REQ_URI_SANS_QS}" />\n` if $editmode;
		$output .= qq`</form>\n` if $editmode;


		if($editmode && $allowed_to_delete)
		{
			$output .= qq`
					<form id="database_deleter" method="post" action="$ENV{SCRIPT_NAME}?$qs&amp;editdelete=true"><div class="enc_tbl enc_db_tbl"><table>
					<tr class="headers"><th>$TEXT{database_deleter_title}</th></tr>
					<tr class="` . oddeven($i) . qq`"><td><input type="checkbox" class="checkbox" name="confirmdeleterecord" id="confirmdeleterecord" /><label for="confirmdeleterecord">` . ($PREF{"${viewerprefname}_record_deletion_warning"} || $TEXT{database_deleter_checkbox}) . qq`</label></td></tr>
					<tr class="` . oddeven($i) . qq`"><td class="button"><input type="hidden" name="enc_form_dfp" value="$live_data_fingerprint" /><input type="submit" class="button" value="$TEXT{database_deleter_button}" /></td></tr>
					</table></div>
					<input type="hidden" name="enc_post_return_url" value="$PREF{REQ_URI_SANS_QS}" />
					</form>
			`;
		}


		$output .= qq`

		<script type="text/javascript">

		function toggle_column(theclass)
		{
			var rows = document.getElementById('${dbtable}_table').getElementsByTagName('tr');

			var cells = new Array;
			for(i = 0; i < rows.length; i++)
			{
				var headers = rows[i].getElementsByTagName('th');
				for(j = 0; j < headers.length; j++)
				{
					//if(headers[j].className == theclass)
					//	cells.push(headers[j]);

					var re = new RegExp('(^| )' + theclass + '( |\$)', "i");
					if(headers[j].className.match(re))
						cells.push(headers[j]);
				}

				var nonheaders = rows[i].getElementsByTagName('td');
				for(j = 0; j < nonheaders.length; j++)
				{
					//if(nonheaders[j].className == theclass)
					//	cells.push(nonheaders[j]);

					var re = new RegExp('(^| )' + theclass + '( |\$)', "i");
					if(nonheaders[j].className.match(re))
						cells.push(nonheaders[j]);
				}
			}
			for(i = 0; i < cells.length; i++)
			{
				if(cells[i].style.display == 'none')
				{
					cells[i].style.display = navigator.userAgent.indexOf("MSIE") ==  -1 ? 'table-cell' : 'block'; // IE doesn't support table-cell...
					document.getElementById("link-" + theclass).style.textDecoration = '';
				}
				else
				{
					cells[i].style.display = 'none';
					document.getElementById("link-" + theclass).style.textDecoration = 'line-through';
				}
			}
		}
		
		</script>

		`;
	}


	my $search_form = '';
	if(!$editmode && !$createmode && $PREF{"${viewerprefname}_allowed_to_search"})
	#if(0) # this is in progress.
	{
		$search_form .= qq`<div id="${dbtable}_search_wrapper" class="db_search">\n<div id="search_title" onclick="showhide_element('db_search_form');">Search:</div>\n`;
		$search_form .= qq`<form method="post" id="db_search_form" action="$ENV{SCRIPT_NAME}?$qs" ` . ($qs !~ /(^|&)srch[123]_(\w+)/ ? qq`style="position: absolute; left: -7000px; height: 0; overflow: hidden;"` : '') . qq`>\n`;
		$search_form .= qq`<div id="${dbtable}_search_table" class="not_enc_tbl">\n<table class="" id="db_viewer_search_table">\n` unless $vertical;
		$search_form .= qq`<tr class="headers">%%headers_horiz_local%%</tr>\n` unless $vertical;

		my $i = 0;
		my $numcols = 0;
		my $oddeven = oddeven($i);
		my $headers_horiz_local = '';
		$search_form .= qq`<div id="${dbtable}_search_table" class="db_search">\n<table>\n` if $vertical;
		$search_form .= qq`<tr class="$oddeven">` unless $vertical;
		foreach my $column (split(/,/, $column_list))
		{
			next if $disabled_columns{$column} || $column =~ /^enchddn_/i;
			next if $$extra_columns{$column}{position} == 1 && $column eq 'edit';
			$numcols++;
			
			$headers_horiz_local .= $headers_horiz{$column};

			my $style_horiz = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_horiz"}{$column} . qq`"`) if exists $PREF{"${viewerprefname}_viewer_style_horiz"}{$column};
			my $style_vert  = (qq`style="` . $PREF{"${viewerprefname}_viewer_style_vert"}{$column} . qq`"`)  if exists $PREF{"${viewerprefname}_viewer_style_vert"}{$column};
			my $style = $vertical ? $style_vert : $style_horiz;
			my $vertclass = 'vertcell' if $vertical;
			$search_form .= qq`<tr class="$oddeven vertrow">` if $vertical;
			$search_form .= $headers_vert{$column} if $vertical;
			
			$search_form .= qq`<td class="col_$column $vertclass" $hidden_cells{$column} $style><input type="text" class="srch_text" name="srch_$column" value="` . (get_qs_var("srch1_$column") || get_qs_var("srch2_$column") || get_qs_var("srch3_$column")) . qq`" />`;
			$search_form .= qq`<br /><input type="radio" name="srchmode_$column" id="srchmode_${column}_1" value="1" ` . ($qs =~ /(^|&)srch1_${column}=/ ? qq`checked="checked"` : '')	. qq`/><label for="srchmode_${column}_1">Must match exactly</label>`;
			$search_form .= qq`<br /><input type="radio" name="srchmode_$column" id="srchmode_${column}_2" value="2" ` . ($qs =~ /(^|&)srch2_${column}=/ ? qq`checked="checked"` : '')	. qq`/><label for="srchmode_${column}_2">Partial match OK</label>`;
			$search_form .= qq`<br /><input type="radio" name="srchmode_$column" id="srchmode_${column}_3" value="3" ` . ($qs =~ /(^|&)srch3_${column}=/ ? qq`checked="checked"` : '')	. qq`/><label for="srchmode_${column}_3">Must not match</label>`;
			$search_form .= qq`<br /><input type="radio" name="srchmode_$column" id="srchmode_${column}_4" value="4" ` . ($qs !~ /(^|&)srch[123]_${column}=/ ? qq`checked="checked"` : '')	. qq`/><label for="srchmode_${column}_4">Unused in this search</label>`;
			$search_form .= qq`</td>`;
			
			$search_form .= qq`</tr>\n` if $vertical;
		}
		$search_form =~ s!%%headers_horiz_local%%!$headers_horiz_local!;

		if(!$vertical)
		{
			$search_form .= qq`</tr>\n`; # unless $vertical;
		}

		#$search_form .= qq`<tr class="` . oddeven($i) . qq` enc_sortbottom">`;
		#$search_form .= qq`<td colspan="$numcols" class="search"><input type="submit" value="$TEXT{database_search_button}" /></td>`;
		#$search_form .= qq`</tr>\n`;
		#
		#$search_form .= qq`</table>\n</div>\n`;

		my $search_reset_url = $qs;
		$search_reset_url =~ s!(^|&)srch[1234]_[^=]+=[^&]+!!g;
		defooify('&', $search_reset_url);
		$search_reset_url = $PREF{REQ_URI_SANS_QS} . '?' . $search_reset_url;

		$search_form .= qq`</table>\n<input type="submit" value="$TEXT{database_search_button}" />\n`;
		$search_form .= qq`<input type="button" name="db_search_form_reset_button" id="db_search_form_reset_button" value="Reset" onclick='if(window.confirm("Really clear the search form?")) { location.href="$search_reset_url"; }' />\n`;
		$search_form .= qq`</div>\n`;

		$search_form .= qq`<input type="hidden" name="searchmode" value="true" />\n`;
		$search_form .= qq`<input type="hidden" name="enc_post_return_url" value="$PREF{REQ_URI_SANS_QS}" />\n`;
		$search_form .= qq`</form>\n</div>\n`;
	}


	$template =~ s!%%output%%!$output!;

	my $uri = $ENV{REQUEST_URI};
	$uri =~ s/(\?|&)format=(horiz|vert)/$1/gi;
	defooify('&', $uri);
	my $horizlink	= $uri . ($uri =~ /\?/ ? '&' : '?') . qq`format=horiz`;
	my $vertlink	= $uri . ($uri =~ /\?/ ? '&' : '?') . qq`format=vert`;
	$uri = $ENV{REQUEST_URI};
	$uri =~ s!editdelete=true!!g;
	$uri =~ s!(edit|create)mode=true!!g;
	$uri =~ s!editid=\d+!!g;
	clean_database_url($uri);
	defooify('&',$uri);
	defooify('\?',$uri);

	my @template_viewcontrols_pruned = ();
	for(@template_viewcontrols)
	{
		if($PREF{"${viewerprefname}_viewer_forced_mode"} =~ /horiz|vert/)
		{
			s!%%(?:horiz|vert)link:text=([^%]+)%%!!g;
		}
		else
		{
			s!%%horizlink:text=([^%]+)%%!$vertical ? qq`<a href="$horizlink">$1</a>` : $1!eg;
			s!%%vertlink:text=([^%]+)%%!$vertical ? $1 : qq`<a href="$vertlink">$1</a>`!eg;
		}

		s!%%viewalllink:text=([^%]+)%%!$editmode || $createmode ? qq`<a href="$uri">$1</a>` : ''!eg;

		push(@template_viewcontrols_pruned, $_) if $_;
	}

	# For example:   %%%if-whence%%% %%whencelink:text=Back To Fields List%% | %%%end-whence%%%
	#
	$template =~ s!%%whencelink:text=([^%]+)%%!$PREF{dbvwrwhence} ? qq`<a href="$PREF{dbvwrwhence}">$1</a>` : ''!eg;
	$template =~ s!%%%if-whence%%%(.*?)%%%end-whence%%%!$PREF{dbvwrwhence} ? $1 : ''!egs;

	$template =~ s!%%%if-db_view_controls%%%(.*?)%%%end-db_view_controls%%%!@template_viewcontrols_pruned ? $1 : ''!egs;
	$template =~ s!%%db_view_controls%%!join $template_viewcontrols_sep, @template_viewcontrols_pruned!egs;

	my $numitems = enc_sql_select("SELECT COUNT(*) FROM `$dbtable` $selection_restrictions");
	my $pagelinks = get_pagination_links_mark2( { range_start => $range_start, range_end => $range_end, num_items => $numitems, items_per_page => $itemsperpage } ) unless $createmode || $editmode;
	$template =~ s!%%%if-pagelinks%%%(.*?)%%%end-pagelinks%%%!$pagelinks ? $1 : ''!egs;
	$template =~ s!%%pagelinks%%!$pagelinks!g;
	$template =~ s!%%search_form%%!$search_form!g;
	$template =~ s!%%itemname_plural%%!$PREF{"${viewerprefname}_viewer_item_name_plural"}!g;
	
	if(get_qs_var('srchvrfymode') eq 'true')
	{
		my $go = $there_were_some_results ? $PREF{"${viewerprefname}_search_verify_mode_redirection_url_for_matches"} : $PREF{"${viewerprefname}_search_verify_mode_redirection_url_for_misses"};;
		my %searchterms = ();
		while($qs =~ /(?:^|&)srch[123]_([^=]+)=([^&]+)/g)
		{
			$searchterms{$1} = $2;
		}
		$go =~ s!%%(\w+)%%!$searchterms{$1}!g;
		if($go)
		{
			enc_redirect($go);
		}
		else
		{
			my $srchmatch = $TEXT{db_search_verify_mode_match_text} || qq`Your search found a match.`;
			my $srchmiss = $TEXT{db_search_verify_mode_miss_text} || qq`Your search found no match.`;
			exit_with_notice($there_were_some_results ? $srchmatch : $srchmiss);
		}
	}

	# This is down here, instead of further up, because we want to allow the allowed_to_search
	# permission to allow access in the case where the search is just returning a matched/failed
	# result (not returning any actual database rows for viewing).  For example, in the situation
	# where a customer needs to be able to look up a license number, registration code, coupon
	# code, etc, and the site owner wants to allow that, but only for verification purposes, not
	# to display the database search result rows to the customer.
	#
	exit_with_needprivs() unless $allowed_to_view;

	return $template;
}


sub send_notification_emails_for_database_update($)
{
	my $details_ref = shift; my %details = %$details_ref;

	my $viewerprefname	= $details{viewerprefname};
	my $recipients		= $PREF{"${viewerprefname}_emailalert_recipients"};
	my $from		= $PREF{"${viewerprefname}_emailalert_sender"};
	my $subject		= $PREF{"${viewerprefname}_emailalert_subject"};
	my $body		= $PREF{"${viewerprefname}_emailalert_body"};
	my $format		= $PREF{"${viewerprefname}_emailalert_type"};
	my $failure_action	= $PREF{"${viewerprefname}_emailalert_failure_action"};

	my $changes_rows = '';
	if($details{changed_record})
	{
		foreach my $col_i (sort { $a <=> $b } keys %{$details{changed_record}})
		{
			my $changes_template = $PREF{"${viewerprefname}_emailalert_changes_template"};
			$changes_template =~ s!%%column%%!$details{changed_record}{$col_i}{column}!g;
			$changes_template =~ s!%%old_value%%!$details{changed_record}{$col_i}{old_value}!g;
			$changes_template =~ s!%%new_value%%!$details{changed_record}{$col_i}{new_value}!g;
			$changes_rows .= $changes_template;
		}
	}

	my $all_rows = '';
	my $sorted_column_list = '';
	my $whole_record = $details{deleted_record} || $details{created_record} || $details{whole_changed_record};
	foreach my $col (sort { lc($a) cmp lc($b) } keys %{$$whole_record{1}})
	{
		$sorted_column_list .= "$col," unless $PREF{"${viewerprefname}_emailalert_fields_to_hide"} =~ /(^|,)\s*$col\s*(,|$)/;
	}
	$sorted_column_list = $PREF{"${viewerprefname}_emailalert_fields_to_show"} if $PREF{"${viewerprefname}_emailalert_fields_to_show"};
	decommaify($sorted_column_list);
	foreach my $col (split(/\s*,\s*/, $sorted_column_list))
	{
		my $allrows_template = $PREF{"${viewerprefname}_emailalert_record_template"};
		$allrows_template =~ s!%%column%%!$col!g;
		$allrows_template =~ s!%%value%%!$$whole_record{1}{$col}!g;
		$all_rows .= $allrows_template;
	}

	$body =~ s!%%username%%!$PREF{logged_in_username} || '(unknown)'!eg;
	$body =~ s!%%action%%!$details{action}!g;
	$body =~ s!%%action_pasttense%%!$details{action_pasttense}!g;
	$body =~ s!%%table%%!$details{table}!g;
	$body =~ s!%%record_id%%!$details{record_id}!g;
	$body =~ s!%%db_url%%!$PREF{"${viewerprefname}_viewer_db_url"}!g;
	$body =~ s!%%db_url_full%%!$PREF{"${viewerprefname}_viewer_db_url_full"}!g;
	$body =~ s!%%changes%%!$PREF{"${viewerprefname}_emailalert_changes_header"}$changes_rows!g;
	$body =~ s!%%record%%!$PREF{"${viewerprefname}_emailalert_record_header"}$all_rows!g;

	$body =~ s!%%%if-edit%%%(.*?)%%%endif-edit%%%!$details{action} eq 'edit' ? $1 : $2!egs;
	$body =~ s!%%%ifelse-deletion%%%(.*?)%%%else%%%(.*?)%%%endelse-deletion%%%!$details{action} eq 'delete' ? $1 : $2!egs;
	
	foreach my $to (split(/\s*,\s*/, $recipients))
	{
		if($to eq 'all_members_of_the_loggedin_users_custom_groups')
		{
			foreach my $to_inner (get_email_addresses_for_all_members_of_this_users_groups($PREF{logged_in_userid}))
			{
				send_email($to_inner, $from, $subject, $body, $format, $failure_action);
			}
		}
		else
		{
			send_email($to, $from, $subject, $body, $format, $failure_action);
		}
	}
}


sub get_return_url_for_dbviewer($$)
{
	my $return_url_base = shift;
	my $viewerprefname = shift;
	my $qsl = $qs;
	$qsl =~ s!format=(horiz|vert)!!g if $qsl =~ /format=horiz/i && $qsl =~ /format=vert/i; # if both are present, remove both.
	$qsl =~ s!format=vert!!; # we always add 1 format=vert on the way to this page, so we should always remove 1 on the way back out.
	$qsl =~ s!editdelete=true!!g;
	$qsl =~ s!editmode=true!!g;
	$qsl =~ s!editid=\d+!!g;
	$qsl =~ s!createmode=true!!g;
	if(exists $PREF{"${viewerprefname}_vars_to_remove_from_redirect_URL"})
	{
		foreach my $var (keys %{ $PREF{"${viewerprefname}_vars_to_remove_from_redirect_URL"} })
		{
			$qsl =~ s!$var=[^&]*!!g;
		}
	}
	defooify('&',$qsl);
	return $return_url_base . ($qsl ? "?$qsl" : '');
}


sub datatype_is_bool($$)
{
	my ($table,$column) = @_;
	my $datatype = get_field_datatype($table,$column);
	return $datatype =~ /^(bool|tinyint\(1\))/i;
}


sub get_field_datatype($$)
{
	my ($table,$column) = @_;
	sql_untaint($table,$column);
	die_unless_sqlsafe($table,$column);

	# This fails on some older MySQL versions, which apparently don't allow the WHERE clause
	# on the SHOW COLUMNS query.  So we'll have to return all columns and manually search them.
	#my $coltypetest = enc_sql_select_multi("SHOW COLUMNS FROM `$table` WHERE `field` = '$column'");
	#return $$coltypetest{1}{Type} || $$coltypetest{1}{type};

	my $coltypetest = enc_sql_select_multi("SHOW COLUMNS FROM `$table`");
	foreach my $j (keys %$coltypetest)
	{
		return ($$coltypetest{$j}{Type} || $$coltypetest{$j}{type}) if ($$coltypetest{$j}{Field} =~ /^$column$/i || $$coltypetest{$j}{field} =~ /^$column$/i);
	}
}


sub get_field_details_from_db($$)
{
	my ($table,$column) = @_;
	sql_untaint($table,$column);
	die_unless_sqlsafe($table,$column);

	my %details = ();
	my $coltypetest = enc_sql_select_multi("SHOW COLUMNS FROM `$table`");
	foreach my $j (keys %$coltypetest)
	{
		 if($$coltypetest{$j}{Field} =~ /^$column$/i || $$coltypetest{$j}{field} =~ /^$column$/i)
		 {
		 	$details{type}		= exists $$coltypetest{$j}{Type}	? $$coltypetest{$j}{Type}	: $$coltypetest{$j}{type};
		 	$details{null}		= exists $$coltypetest{$j}{Null}	? $$coltypetest{$j}{Null}	: $$coltypetest{$j}{null};
		 	$details{key}		= exists $$coltypetest{$j}{Key}		? $$coltypetest{$j}{Key}	: $$coltypetest{$j}{key};
		 	$details{default}	= exists $$coltypetest{$j}{Default}	? $$coltypetest{$j}{Default}	: $$coltypetest{$j}{default};
		 	$details{extra}		= exists $$coltypetest{$j}{Extra}	? $$coltypetest{$j}{Extra}	: $$coltypetest{$j}{extra};
		 	
		 	# For integer types, the returned value will be something like one of the following:
		 	#
		 	#	bigint(20)
		 	#	int(10) unsigned
		 	#
		 	# But the number in parentheses is added by MySQL automatically (i.e. even when you
		 	# don't specify it when creating the column, which you wouldn't in most cases), and
		 	# it is NOT an indicator of the field size, as the MySQL manual explains:
		 	#
		 	#	http://dev.mysql.com/doc/refman/5.0/en/numeric-types.html
		 	#	
		 	#	Numeric Type Attributes
		 	#	
		 	#	MySQL supports an extension for optionally specifying the display width of
		 	#	integer data types in parentheses following the base keyword for the type.
		 	#	For example, INT(4) specifies an INT with a display width of four digits.
		 	#	This optional display width may be used by applications to display integer
		 	#	values having a width less than the width specified for the column by
		 	#	left-padding them with spaces. (That is, this width is present in the
		 	#	metadata returned with result sets. Whether it is used or not is up to the
		 	#	application.)
			#	
			#	The display width does *not* constrain the range of values that can be stored
			#	in the column. Nor does it prevent values wider than the column display width
			#	from being displayed correctly. For example, a column specified as
			#	SMALLINT(3) has the usual SMALLINT range of -32768 to 32767, and values
			#	outside the range permitted by three digits are displayed in full using more
			#	than three digits. 
		 	#	
		 	# Therefore, for our purposes here, where in 99% of cases we didn't specify this number
		 	# explicitly, and therefore it's meaningless in the context of determining whether the
		 	# column type has changed, we will remove this number.
		 	#
		 	$details{type} =~ s!int\(\d+\)!int!;
		 	
		 	return \%details;
		 }
	}
}


sub get_field_details_from_creation_string($)
{
	my ($creation_string) = @_;

	my %details = ();
 	$details{type}		= ($creation_string =~ m!^(\S+( unsigned)?)!i)[0];
 	$details{null}		= $creation_string =~ m!not null!i ? 'NO' : 'YES';
 	$details{key}		= $creation_string =~ m!primary key!i ? 'PRI' : ''; # TODO: add detection of other key types.
	$details{default}	= $creation_string =~ m!default (\S+)!i ? $1 : ''; # TODO: some types have a default DEFAULT value other than NULL.
	$details{extra}		= $creation_string =~ m!auto_increment!i ? 'auto_increment' : ''; # TODO: potentially lots of other stuff here.
 	
	$details{type} =~ s!int\(\d+\)!int!; # see note in the get_field_details_from_db() sub.

	$details{default} =~ s!^'(.*)'$!$1!; # In case the specified default value is quoted, remove
	$details{default} =~ s!^"(.*)"$!$1!; # the quotes before actually using/comparing the value.
	 	
 	return \%details;
}


sub field_datatype_has_changed($$$)
{
	my ($table,$fieldname,$creation_string) = @_;
	my $new_fieldtype = get_field_details_from_creation_string($creation_string);
	my $old_fieldtype = get_field_details_from_db($table,$fieldname);
	
	my $changed = 0;
	my ($old,$new) = ();
	foreach my $attrib (sort keys %$old_fieldtype)
	{
		$changed = 1 if lc($$old_fieldtype{$attrib}) ne lc($$new_fieldtype{$attrib});
		$old .= "old $attrib: " . lc($$old_fieldtype{$attrib}) . "; ";
		$new .= "new $attrib: " . lc($$new_fieldtype{$attrib}) . "; ";
	}

	if($changed)
	{
		encdebug "datatype has changed for '$fieldname':\nold=$old\nnew=$new\n";
		return 1;
	}
	else
	{
		encdebug "datatype has NOT changed for '$fieldname':\nold=$old\nnew=$new\n";
		return 0;
	}
}


sub clean_database_url
{
	$_[0] =~ s!format=(horiz|vert)!!g if $_[0] =~ /format=horiz/ && $_[0] =~ /format=vert/; # if both are present, remove all.
	for('horiz','vert')
	{
		if($_[0] =~ /format=$_/) { $_[0] =~ s!format=$_!!g; $_[0] .= "&format=$_"; } # condense multiple occurrences of the same one.
	}
	$_[0] =~ s!\?&+!?!g;
}


sub verify_new_database_value($$$$$$)
{
	# Notes:
	#
	#	_viewer_unique_values and _viewer_unique_values_ignorecase require that
	# 	the table has a column called "id" which is unique and not null.
	#

	my ($dbtable,$viewerprefname,$column,$value,$rowid,$all_fields) = @_;
	sql_untaint($value,$column);
	die_unless_sqlsafe($value,$column);

	if(exists $PREF{"${viewerprefname}_viewer_unique_values"}{lc($column)})
	{
		if($rowid =~ /^\d+$/) # edit mode.
		{
			if(enc_sql_select("SELECT COUNT(*) FROM `$dbtable` WHERE `$column` = '$value' AND `id` != $rowid"))
			{
				exit_with_error(qq`Error: '$column' must be unique, but the one you entered ('$value') already exists.`);
			}
		}
		else # add-new-record mode.
		{
			if(enc_sql_select("SELECT COUNT(*) FROM `$dbtable` WHERE `$column` = '$value'"))
			{
				exit_with_error(qq`Error: '$column' must be unique, but the one you entered ('$value') already exists.`);
			}
		}
	}

	if(exists $PREF{"${viewerprefname}_viewer_unique_values_ignorecase"}{lc($column)})
	{
		if($rowid =~ /^\d+$/) # edit mode.
		{
			if(enc_sql_select("SELECT COUNT(*) FROM `$dbtable` WHERE LOWER(`$column`) = LOWER('$value') AND `id` != $rowid"))
			{
				exit_with_error(qq`Error: '$column' must be unique, but the one you entered ('$value') already exists.`);
			}
		}
		else # add-new-record mode.
		{
			if(enc_sql_select("SELECT COUNT(*) FROM `$dbtable` WHERE LOWER(`$column`) = LOWER('$value')"))
			{
				exit_with_error(qq`Error: '$column' must be unique, but the one you entered ('$value') already exists.`);
			}
		}
	}

	# 201001: APICHANGE: $PREF{"${viewerprefname}_viewer_value_verifications"}{lc($column)} was a string; now it's a hash.
	#
	if(exists $PREF{"${viewerprefname}_viewer_value_verifications"}{lc($column)})
	{
		foreach my $testnum (keys %{ $PREF{"${viewerprefname}_viewer_value_verifications"}{lc($column)} })
		{
			my $code = $PREF{"${viewerprefname}_viewer_value_verifications"}{lc($column)}{$testnum};
			if($code =~ /^preset:(.+)/)
			{
				foreach my $preset (split(/\s*,\s*/, $1))
				{
					my ($error,%vars) = ('',());
					   if(($preset eq 'nonnull')		&& (!$value && ($value !~ /^0$/)))	{ $error = $TEXT{Error_input_null}; }
					elsif(($preset eq 'alnum')		&& ($value !~ /^[[:alnum:]]*$/))	{ $error = $TEXT{Error_input_not_alnum}; }
					elsif(($preset eq 'word')		&& ($value !~ /^\w*$/))			{ $error = $TEXT{Error_input_not_word}; }
					elsif(($preset eq 'numeric')		&& ($value !~ /^\d*$/))			{ $error = $TEXT{Error_input_not_numeric}; }
					elsif(($preset =~ /^minvalue=(\d+)$/)	&& ($value < $1))			{ $error = $TEXT{Error_input_too_small}; $vars{min} = $1; }
					elsif(($preset =~ /^maxvalue=(\d+)$/)	&& ($value > $1))			{ $error = $TEXT{Error_input_too_large}; $vars{max} = $1; }
					elsif(($preset =~ /^minlength=(\d+)$/)	&& (length($value) < $1))		{ $error = $TEXT{Error_input_too_short}; $vars{min} = $1; }
					elsif(($preset =~ /^maxlength=(\d+)$/)	&& (length($value) > $1))		{ $error = $TEXT{Error_input_too_long}; $vars{max} = $1; }
					#print STDERR "column=$column, value=$value, preset=$preset, error=$error\n";

					if($error) { $error =~ s/%%encfieldname%%/$column/g; $error =~ s/%%(\w+)%%/$vars{$1}/g; kmsg_redirect($error); }
				}
			}
			else
			{
				$code =~ s/%%variable%%/\$value/g;
				$code =~ s/%%encfieldname%%/$column/g;
				$code =~ s/%%(\w+)%%/$$all_fields{$1}/g;
				eval $code; # modified $value directly.
				die $@ if $@; # in case the custom code had an error in it.
				# die_from_eval: can accept a whole literal message, or "smsg_foo" which maps to $TEXT{smsg_foo} -- where possible, use static messages rather than keyed messages.
				if($value =~ /die_from_eval:(.*)/) { my $msg = $1; $msg =~ m!^smsg_(.+)! ? smsg_redirect($1) : kmsg_redirect($msg); }
			}
		}
	}
}


sub transform_value_according_to_code
{
	my $dbtable		= shift;
	my $value		= shift;
	my $values		= shift; # hashref
	my $code		= shift;
	my $column		= shift;
	my $pass		= shift;
	my $already_transformed = shift; # hashref.

	if($code =~ /^preset:(.+)/)
	{
		foreach my $preset (split(/\s*,\s*/, $1))
		{
			   if($preset eq 'make_lowercase')	{ $value = lc($value); }
			elsif($preset eq 'make_uppercase')	{ $value = uc($value); }
			elsif($preset eq 'remove_nonalnum')	{ $value =~ s![^[:alnum:]]!!g; }
			elsif($preset eq 'date8')		{ $value = strftime("%Y%m%d",localtime(offsettime())); }
			elsif($preset eq 'date17')		{ $value = strftime("%Y%m%d-%H:%M:%S",localtime(offsettime())); }
			elsif($preset eq 'etime')		{ $value = offsettime(); }

			elsif($preset eq 'next_int_if_null_or_zero' && !$value)
			{
				$value = enc_sql_select("SELECT MAX(`$column`) FROM `$dbtable`") =~ /^(\d+)$/ ? $1 : 0; $value++;
			}

			#print STDERR "column=$column, value=$value, preset=$preset\n";
		}
		$$values{$column} = $value;
	}
	else
	{
		$code =~ s/%%variable%%/\$value/g;
		$code =~ s/%%(\w+)%%/exists $$values{$1} || $pass==2 ? $$values{$1} : $&/eg;
		if($code !~ /%%\w+%%/ || $pass==2)
		{
			if(!$$already_transformed{$column})
			{
				$$already_transformed{$column} = 1;
				eval $code; # modifies $value directly.
				$$values{$column} = $value;
			}
		}
	}
}


sub get_pagination_range($)
{
	my $items_per_page = $_[0];
	my $page_num = $qs =~ /(?:^|&)page=(\d+)(?:&|$)/ ? $1 : 1;
	my $range_start = ($items_per_page * ($page_num - 1)) + 1; # $range_start = 1 if $range_start < 1; # negative check not necessary if $page_num is guaranteed to be >= 1.
	my $range_end = $items_per_page * $page_num;
	my $sql_range_start = $range_start - 1; # because SQL's LIMIT is zero-based.

	($range_start,$range_end,$sql_range_start) = (1,999999999,0) if $qs =~ /(?:^|&)pagination=off(?:&|$)/;

	# We need to adjust itemsperpage (in the caller), not just the range start & end, when
	# pagination=off, because SQL's 'LIMIT' uses range_start & itemsperpage (not range_end).
	$_[0] = 999999999 if $qs =~ /(?:^|&)pagination=off(?:&|$)/;

	return ($range_start,$range_end,$sql_range_start);
}


sub get_pagination_links_mark2
{
	## first 4 args are mandatory; rest are optional.
	#my ($range_start, $range_end, $num_items, $items_per_page,
	#	$itemname_singular,
	#	$itemname_plural,
	#	$pagename_singular,
	#	$pagename_plural,
	#	$template,
	#	$num_pagelinks,
	#	$viewall_template
	#) = @_;
	#
	# 20110226: APICHANGE: args for this sub are now hash-based:
	#
	my $optsref = shift; my %opts = %$optsref if $optsref;

	$opts{template} ||= qq`
		<div class="pagelinks">
			<div class="text">
			<span class="bookend">{</span>%%num_items%% %%itemname%% on %%num_pages%% %%pagename%%.
			%%%if-show_opts_links%%%
				&nbsp;Options: &nbsp; %%alllink%% %%%if-show_sort_links%%%&nbsp; %%quicksortlink%% %%%end-show_sort_links%%%
			%%%end-show_opts_links%%%
			<span class="bookend">}</span>
			</div>

			%%%if-multiple_pages%%%
			<div class="links">
			%%%ifelse-frstlink%%% <a href="%%frstlink%%" class="first">&lt;&lt;</a>	%%%else%%% <span class="disabled first">&lt;&lt;</span>	%%%endelse-frstlink%%% %%spc%%
			%%%ifelse-prevlink%%% <a href="%%prevlink%%">&lt;</a>			%%%else%%% <span class="disabled">&lt;</span>		%%%endelse-prevlink%%% %%spc%%

			%%%template:linklist%%%
				%%%ifelse-currentpage%%%
					<span class="current">%%pagenum%%</span> %%spc%%
				%%%else%%%
					<a href="%%link%%">%%pagenum%%</a> %%spc%%
				%%%endelse-currentpage%%%
			%%%end-template:linklist%%%

			%%%ifelse-nextlink%%% <a href="%%nextlink%%">&gt;</a>			%%%else%%% <span class="disabled">&gt;</span>		%%%endelse-nextlink%%% %%spc%%
			%%%ifelse-lastlink%%% <a href="%%lastlink%%" class="last">&gt;&gt;</a>	%%%else%%% <span class="disabled last">&gt;&gt;</span>	%%%endelse-lastlink%%%
			</div>
			%%%end-multiple_pages%%%
		</div>
	`;

	$opts{viewall_template} ||= qq`
		<div class="pagelinks">
		(Viewing all %%num_items%% %%itemname%%.&nbsp; <a href="%%pageslink%%">View individual pages?</a>)
		</div>
	`;

	$opts{itemname_singular}	||= $TEXT{item}		|| 'item';
	$opts{itemname_plural}		||= $TEXT{items}	|| 'items';
	$opts{pagename_singular}	||= $TEXT{page}		|| 'page';
	$opts{pagename_plural}		||= $TEXT{pages}	|| 'pages';
	$opts{num_pagelinks}		||= 8;
	my $spacer			= $PREF{pagination_links_spacer} || '';

	my $num_pages = int($opts{num_items}/$opts{items_per_page});
	$num_pages++ if $num_pages < ($opts{num_items}/$opts{items_per_page});
	return '' if $opts{hide_when_single_page} && $num_pages =~ /^(0|1)$/ && get_qs_var('pagination') ne 'off';

	my $viewall_active	= (get_qs_var('pagination') eq 'off') || ($num_pages == 1);
	my $viewall_unclickable	= (get_qs_var('pagination') ne 'off') && ($num_pages == 1);

	my ($link_template) = ($opts{template} =~ m!%%%template:linklist%%%(.+?)%%%end-template:linklist%%%!gs);
	my $link_template_output = '';
	my %pagelinks = ();

	#if($qs =~ /pagination=off/)
	#if($viewall_active)
	if(0)
	{
		my $uri = $ENV{REQUEST_URI};
		$uri =~ s/pagination=off//g;
		defooify('&', $uri);
		$opts{viewall_template} =~ s!%%pageslink%%!$uri!g;
		$opts{viewall_template} =~ s!%%num_items%%!$opts{num_items}!g;
		$opts{viewall_template} =~ s!%%itemname%%!$opts{num_items} == 1 ? $opts{itemname_singular} : $opts{itemname_plural}!eg if $opts{itemname_singular} && $opts{itemname_plural};
		return $opts{viewall_template};
	}
	#elsif($opts{range_start} != 1   ||   $opts{num_items} > $opts{range_end})
	elsif(1)
	{
		my $uri = $ENV{REQUEST_URI};

		# Remove any existing phase/resultmsg, and page number, from the
		# URI, because we don't want to include those on each new page.
		#
		$uri =~ s/(\?|&)page=(\d+)/$1/g;
		$uri =~ s/(\?|&)phase=(\w+)/$1/g;
		$uri =~ s/(\?|&)rsltmsg=(\w+)/$1/g;

		my $uri_for_quicksort_link = my $uri_for_pagination_link = $uri;
		$uri_for_quicksort_link =~ s/(\?|&)quicksort=(on|off)/$1/g;
		$uri_for_pagination_link =~ s/(\?|&)pagination=(on|off)/$1/g;

		for($uri, $uri_for_quicksort_link, $uri_for_pagination_link)
		{
			$_ .= '?' unless $_ =~ /\?/;
			$_ .= '&' if $_ =~ /\?.+/ && $_ !~ /&$/;
			$_ =~ s/&{2,}/&/g;
			$_ =~ s/\?&/?/g;
		}

		my $current_page = 1;
		for(my $j = 1; $j <= $num_pages; $j++)
		{
			my $is_currentpage = ($ENV{REQUEST_URI} =~ /page=$j/ || ($ENV{REQUEST_URI} !~ /page=\d+/ && $j==1));
			$current_page = $j if $is_currentpage;

			my $link_template_local = $link_template;
			$link_template_local =~ s!%%pagenum%%!$j!g;
			$link_template_local =~ s!%%link%%!${uri}page=$j!g;
			$link_template_local =~ s!%%%ifelse-currentpage%%%(.*?)%%%else%%%(.*?)%%%endelse-currentpage%%%!$is_currentpage ? $1 : $2!egs;
			$pagelinks{$j} = $link_template_local;
		}

		foreach my $page (sort { $a <=> $b } keys %pagelinks)
		{
			$link_template_output .= $pagelinks{$page} if (($page - int($opts{num_pagelinks}/2 + .5)) <= $current_page) && ($current_page <= ($page + int($opts{num_pagelinks}/2 + .5)));
		}

		my $prevlink = $current_page > 1 ? $current_page - 1 : 1;
		my $nextlink = $current_page < $num_pages ? $current_page + 1 : $num_pages;
		$opts{template} =~ s!%%prevlink%%!${uri}page=$prevlink!g;
		$opts{template} =~ s!%%nextlink%%!${uri}page=$nextlink!g;
		$opts{template} =~ s!%%alllink%%!$viewall_unclickable ? qq`<span class="disabled">view all</span>` : $viewall_active ? qq`<a href="${uri_for_pagination_link}">view pages</a>` : qq`<a href="${uri_for_pagination_link}pagination=off">view all</a>`!eg;
		$opts{template} =~ s!%%quicksortlink%%!quicksort_is_active() ? qq`<a href="${uri_for_quicksort_link}quicksort=off">server-sort</a>` : qq`<a href="${uri_for_quicksort_link}quicksort=on">quick-sort</a>`!eg;
		$opts{template} =~ s!%%%if-show_opts_links%%%(.*?)%%%end-show_opts_links%%%!$opts{hide_opts_links} ? '' : $1!egs;
		$opts{template} =~ s!%%%if-show_sort_links%%%(.*?)%%%end-show_sort_links%%%!$opts{hide_sort_links} ? '' : $1!egs;
		$opts{template} =~ s!%%%ifelse-prevlink%%%(.*?)%%%else%%%(.*?)%%%endelse-prevlink%%%!$current_page ne 1 ? $1 : $2!egs;
		$opts{template} =~ s!%%%ifelse-nextlink%%%(.*?)%%%else%%%(.*?)%%%endelse-nextlink%%%!$current_page ne $num_pages ? $1 : $2!egs;
		$opts{template} =~ s!%%%if-multiple_pages%%%(.*?)%%%end-multiple_pages%%%!$num_pages > 1 ? $1 : ''!egs;

		$opts{template} =~ s!%%frstlink%%!${uri}page=1!g;
		$opts{template} =~ s!%%lastlink%%!${uri}page=$num_pages!g;
		$opts{template} =~ s!%%%ifelse-frstlink%%%(.*?)%%%else%%%(.*?)%%%endelse-frstlink%%%!$current_page ne 1 ? $1 : $2!egs;
		$opts{template} =~ s!%%%ifelse-lastlink%%%(.*?)%%%else%%%(.*?)%%%endelse-lastlink%%%!$current_page ne $num_pages ? $1 : $2!egs;

		$opts{template} =~ s!%%%template:linklist%%%(.+?)%%%end-template:linklist%%%!$link_template_output!gs;
		$opts{template} =~ s!%%spc%%!$spacer!g;
		$opts{template} =~ s!%%num_items%%!$opts{num_items}!g;
		$opts{template} =~ s!%%num_pages%%!$num_pages!g;
		$opts{template} =~ s!%%itemname%%!$opts{num_items} == 1 ? $opts{itemname_singular} : $opts{itemname_plural}!eg if $opts{itemname_singular} && $opts{itemname_plural};
		$opts{template} =~ s!%%pagename%%!$num_pages == 1 ? $opts{pagename_singular} : $opts{pagename_plural}!eg if $opts{pagename_singular} && $opts{pagename_plural};

		return $opts{template};
	}
	else
	{
		return '';
	}
}


sub quicksort_is_active
{
	return (get_qs_var('quicksort') eq 'on') || ($PREF{enable_quicksort_by_default} =~ /yes/i && get_qs_var('quicksort') ne 'off');
}


sub field_structure_managed_by_us
{
	my $field = shift;
	foreach my $table (keys %{$PREF{tables_listing_fields_whose_structure_we_manage}})
	{
		sql_untaint($field,$table);
		die_unless_sqlsafe($field,$table);
		my $query = "SELECT `fieldtype`,`fieldlabel`,`listitems`,`defaultvalue` FROM `$table` WHERE `fieldname` = '$field'";
		#enc_warn "query=$query\n";

		if(my ($fieldtype,$label,$listitems,$defaultvalue) = enc_sql_select($query))
		{
			#enc_warn qq`fieldtype,label,listitems,defaultvalue = $fieldtype,$label,$listitems,$defaultvalue\n`;
			if($fieldtype =~ /^(freeformsingle|freeformmulti|dropdown|checkbox|radio)$/)
			{
				return ($fieldtype,$label,$listitems,$defaultvalue);
			}
			else
			{
				return ();
			}
		}
	}
}


sub is_valid_email_address
{
	return $_[0] =~ /^[\w\.\+-]+\@[\w\.-]+\.\w+$/;
}


sub is_ipv4_address
{
	return $_[0] =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
}


sub interpolate_vars_from_URL_and_cookies
{
	my $include_undefined = 0;
	my $sql_sanitize = 0;

	my %url_vars = ();
	for(split(/&/, $qs))
	{
		my ($var,$value) = split(/=/);
		enc_urldecode($value);
		$url_vars{$var} = $value;
	}

	my %cookies = ();
	my %jar = get_cookies();
	foreach my $ck (keys %jar)
	{
		$cookies{$ck} = $jar{$ck}->value;
	}

	for(@_)
	{
		$include_undefined = $_ if $_ eq 'include_undefined';
		$sql_sanitize = $_ if $_ eq 'sql_sanitize';

		next unless m!(%URL{|%COOKIE{)!;

		if($sql_sanitize)
		{
			my %done = ();
			while(m!%URL\{([^\{\}]+)\}!g)
			{
				my $varname = $1;
				if(exists $url_vars{$varname}   &&   !$done{$varname})
				{
					sql_untaint($url_vars{$varname});
					replace_nonsqlsafe_chars_with('_', $url_vars{$varname});
					die_unless_sqlsafe($url_vars{$varname});
					$done{$varname} = 1;
				}
			}

			%done = ();
			while(m!%COOKIE\{([^\{\}]+)\}!g)
			{
				my $varname = $1;
				if(exists $cookies{$varname}   &&   !$done{$varname})
				{
					sql_untaint($cookies{$varname});
					replace_nonsqlsafe_chars_with('_', $cookies{$varname});
					die_unless_sqlsafe($cookies{$varname});
					$done{$varname} = 1;
				}
			}
		}

		s!%URL\{([^\{\}]+)\}!exists $url_vars{$1} || $include_undefined ? $url_vars{$1} : $&!eg;
		s!%COOKIE\{(.+?)\}!exists $cookies{$1} || $include_undefined ? $cookies{$1} : $&!eg;
	}
}


sub interpolate_vars_from_prefs
{
	my $include_undefined = $_[0] eq 'include_undefined' ? shift : 0;	# 1st arg may be 'include_undefined' but does not have to be.
	for(@_)
	{
		s/%PREF{(\w+)}/exists $PREF{$1} || $include_undefined ? $PREF{$1} : $&/eg;
		s/%TEXT{(\w+)}/exists $TEXT{$1} || $include_undefined ? $TEXT{$1} : $&/eg;
	}
}


sub interpolate_vars_from_env
{
	my $include_undefined = $_[0] eq 'include_undefined' ? shift : 0;	# 1st arg may be 'include_undefined' but does not have to be.
	for(@_)
	{
		s/%ENV{(\w+)}/exists $ENV{$1} || $include_undefined ? $ENV{$1} : $&/eg;
	}
}


sub interpolate_vars_from_sql
{
	my $include_undefined = $_[0] eq 'include_undefined' ? shift : 0;	# 1st arg may be 'include_undefined' but does not have to be.
	for(@_)
	{
		while(m!(%SQL\{\{(.+?)\}\})!g)
		{
			my ($wholething,$sql_statement) = ($1,$2);
			get_db_connection() unless $PREF{dbh};
			interpolate_vars_from_URL_and_cookies($include_undefined, 'sql_sanitize', $sql_statement);
			my $output = enc_sql_select($sql_statement);
			s!\Q$wholething\E!$output!g;
		}
	}
}


sub interpolate_vars_from_date
{
	my $include_undefined = $_[0] eq 'include_undefined' ? shift : 0;	# 1st arg may be 'include_undefined' but does not have to be.
	my $etime = $_[0] =~ /^etime=(\d+)$/ ? shift : offsettime();
	$etime =~ s/[^\d]//g;
	s!%DATE{(.+?)}{now([\+-]\d+[smhdb])}!strftime($1,localtime(offset_etime($etime,$2)))!eg for @_;
	s!%DATE{(.+?)}!strftime($1,localtime($etime))!eg for @_;
}


sub do_standard_template_conditionals_processing
{
	for(@_)
	{
		s!%%%if-admin_is_logged_in%%%(.*?)%%%end-admin_is_logged_in%%%!$PREF{admin_is_logged_in} ? $1 : ''!egs;
		s!%%%if-admin_not_logged_in%%%(.*?)%%%end-admin_not_logged_in%%%!$PREF{admin_is_logged_in} ? '' : $1!egs;
		s!%%%ifelse-admin_is_logged_in%%%(.*?)%%%else%%%(.*?)%%%endelse-admin_is_logged_in%%%!$PREF{admin_is_logged_in} ? $1 : $2!egs;

		s!%%%if-member_is_logged_in%%%(.*?)%%%end-member_is_logged_in%%%!$PREF{member_is_logged_in} ? $1 : ''!egs;
		s!%%%if-member_not_logged_in%%%(.*?)%%%end-member_not_logged_in%%%!$PREF{member_is_logged_in} ? '' : $1!egs;
		s!%%%ifelse-member_is_logged_in%%%(.*?)%%%else%%%(.*?)%%%endelse-member_is_logged_in%%%!$PREF{member_is_logged_in} ? $1 : $2!egs;

		s!%%%if-member_of_group_([^%]+)%%%(.*?)%%%end-member_of_group_\1%%%!user_is_member_of_group($PREF{logged_in_userid}, $1) ? $2 : ''!egs;
		s!%%%if-not_member_of_group_([^%]+)%%%(.*?)%%%end-not_member_of_group_\1%%%!user_is_member_of_group($PREF{logged_in_userid}, $1) ? '' : $2!egs;

		s!%%%ifelse-member_of_group_([^%]+)%%%(.*?)%%%else%%%(.*?)%%%endelse-member_of_group_\1%%%!user_is_member_of_group($PREF{logged_in_userid}, $1) ? $2 : $3!egs;
		s!%%%ifelse-not_member_of_group_([^%]+)%%%(.*?)%%%else%%%(.*?)%%%endelse-not_member_of_group_\1%%%!user_is_member_of_group($PREF{logged_in_userid}, $1) ? $3 : $2!egs;

		s!%%%if-allowed_to_(\w+)%%%(.*?)%%%end-allowed_to_\1%%%!user_is_allowed_to($1) ? $2 : ''!egs;
		s!%%%ifelse-allowed_to_(\w+)%%%(.*?)%%%else%%%(.*?)%%%endelse-allowed_to_\1%%%!user_is_allowed_to($1) ? $2 : $3!egs;
	}
}


sub do_standard_template_vars_processing
{
	interpolate_vars_from_sql(@_); # do this one first, so we can SQL-sanitize any nested URL/cookie variables and interpolate them manually, rather than letting the following functions do the regular interpolation with no SQL-sanitization.
	interpolate_vars_from_env(@_);
	interpolate_vars_from_prefs(@_);
	interpolate_vars_from_URL_and_cookies(@_);
	interpolate_vars_from_date(@_);
}


sub do_standard_template_leftover_nulling
{
	# Go in order from most specific to least specific.  For example, %%%set...%%%
	# is near the end, because it can contain spaces, so we need to make the
	# regex a little looser to match it.  And we explicitly match %%\w+%% even
	# though we later have a more generic %%[^%\s]+?%% because removing the
	# simple all-alphanumeric vars first makes it more straightforward to match
	# the more varied possibilities later.

	for(@_)
	{
		s!%%%if-(\S+)%%%.+?%%%end-\1%%%!!gs;
		s!%%%ifelse-(\S+)%%%.*?%%%else%%%.*?%%%endelse-\1%%%!!gs;
		s!%%%calculate:([^%]+)%%%.+?%%%end-calculate%%%!!gs;
		s!%%%customcode(:[^%]+)?%%%.+?%%%end-customcode%%%!!gs;
		s!%%\w+%%!!g;
		#s!%%[^%\s]+?%%!!g;
		s!%%%set[^%]+?%%%!!g;
	}
}


sub do_standard_template_oddeven_processing # make this your last template-processing action, so any %%oddeven%%s present will definitely be present in the output.
{
	for(@_)
	{
		my $i = 0; while(/%%oddeven%%/g) { s!%%oddeven%%!oddeven($i)!e; }
	}
}


# This sub is designed to skip any interpolations that are currently null and/or
# whose values have other raw template variables within them.  This allows the
# template's various operations and variables to be nested in arbitrarily deep
# and complex ways.  Because of this, the sub iterates multiple times, since
# items that were skipped on earlier passes will be able to be processed on
# later passes.
#
sub do_custom_template_processing
{
	my $templatevars = shift; # hashref.
	for(my $i=0; $i<8; $i++)
	{
		for(@_)
		{
			s!%%%if-([^%]+)==([^%]+)%%%(.*?)%%%end-\1==\2%%%!$1 eq $2 ? $3 : ''!egs;

			s!%%%if-is_valid_price_([^%]+)%%%(.*?)%%%end-is_valid_price_\1%%%!item_price_is_valid($1) ? $2 : ''!egs;

			#while(m!\s*%%%set-urlencoded:(\w+)=([^%]*)%%%\s*!g)
			#{
			#	my ($name,$val) = ($1,$2);
			#	enc_urlencode($val);
			#	$$templatevars{$name} = $val;
			#}

			$$templatevars{$1} = $2 while $_ =~ m!\s*%%%set:(\w+)=([^%]*)%%%\s*!g;
			s!%%(\w+?)%%!exists $$templatevars{$1} ? $$templatevars{$1} : $&!eg;
			s!%%(\w+?)_urlencoded%%!exists $$templatevars{$1} ? enc_urlencode_return($$templatevars{$1}) : $&!eg;

			while(m!(%%%calculate:([^%]+)%%%\s*(.+?)\s*%%%end-calculate%%%)!gs)
			{
				#die "code is: '$3', wholething is: '$1'";
				my ($wholething,$options,$code) = ($1,$2,$3);

				next if $code =~ /%%\w+%%/; # skip it if it still has unprocessed variables in it.

				my $output = eval $code;
				exit_with_error($1) if $output =~ /die_from_eval:(.*)/;
				my $outputvarname = '';

				for(split(/\s*,\s*/, $options))
				{
					if(/numdecimals=(\d+)/)
					{
						my $numdec = $1;
						$output =~ s/(\.\d{$numdec})\d+$/$1/;
						$output .= '.' unless $output =~ /\.\d*$/;
						$output .= '0' while length(   ($output =~ /\.(\d*)$/)[0]   ) < $numdec;
					}
					elsif(/varname=(\w+)/)
					{
						$outputvarname = $1;
					}
				}

				s!\Q$wholething\E!%%%set:$outputvarname=$output%%%!s;
			}

			while(m!(%%%customcode(:[^%]+)?%%%\s*(.+?)\s*%%%end-customcode%%%)!gs)
			{
				#die "code is: '$3', wholething is: '$1'";
				my ($wholething,$options,$code) = ($1,$2,$3);

				next if $code =~ /%%\w+%%/; # skip it if it still has unprocessed variables in it.

				my $output = eval $code;

				exit_with_error($1) if $output =~ /die_from_eval:(.*)/;

				s!\Q$wholething\E!!s;
			}

			if(exists $$templatevars{eitemcode} && exists $$templatevars{eitemname} && exists $$templatevars{eitemdesc} && exists $$templatevars{eitemopts} && exists $$templatevars{eitemcost})
			{
				$$templatevars{eitemfingerprint} = get_cart_item_fingerprint(
										$$templatevars{eitemcode},
										$$templatevars{eitemname},
										$$templatevars{eitemdesc},
										$$templatevars{eitemopts},
										$$templatevars{eitemcost}
				);
			}
		}
	}
}


# Create a fingerprint before and after adding the item to the cart, to
# prevent modification of any of the values (particularly the price).
#
sub get_cart_item_fingerprint($$$$$)
{
	return enc_hash(
			$PREF{database_name} . $PREF{database_username} . $PREF{database_password} . 
			$_[0] . $_[1] . $_[2] . $_[3] . $_[4] . 
			$ENV{DOCUMENT_ROOT} . $ENV{PATH} . $ENV{SCRIPT_FILENAME}
	);
}


sub format_xml_nicely
{
	my $input_xml = shift;
	my $output_xml = '';
	my $depth = 0;
	my $prev_line_was_opener = 0;
	while($input_xml =~ /(<[^<>]+>)/g)
	{
		my $line = $1;
		#print STDERR "Line is: '$line'\n";
		my $opener = 0;
		if($line =~ m!^<\?xml!i)
		{
			$output_xml .= "$line\n";
			next;
		}
		elsif($line =~ m!^<[^<]+/>$!)
		{
			$depth++ if $prev_line_was_opener;
		}
		elsif($line =~ m!^</[^<]+>$!)
		{
			$depth--;
			$opener = 0;
			#$line .= '-';
		}
		elsif($line =~ m!^<[^<]+>$!)
		{
			$depth++;
			$opener = 1;
			#$line .= '+';
		}

		$output_xml .= '  ' x ($depth - 1);
		$output_xml .= "$line\n";

		$prev_line_was_opener = $opener;
	}
	return $output_xml;
}


sub is_zero # to differentiate values from null.
{
	return $_[0] =~ /^0$/;
}


sub dumphash
{
	my ($hashref,$separator) = @_;
	$separator ||= ', ';
	my $output = '';
	foreach my $key (sort keys %$hashref) { $output .= "$key=$$hashref{$key}$separator"; }
	$output =~ s!$separator$!!;
	return $output;
}


sub remove_common_leading_substring
{
	# Pass in an array of strings, and this sub will remove any common leading
	# portion from each of the strings in the array.  Note: this currently has
	# a hard-coded relief valve (the "$done = 1 if $i > N") until it gets more
	# widespread testing, because a malfunction could result in an infinite loop.

	my $done = 0;
	my $i = 0;
	my $longest_common_substring = '';
	while(!$done)
	{
		$i++;
		#print STDERR "increasing \$i to $i\n";
		my $substring = '';
		for(@_)
		{
			#print STDERR "\tprocessing $_ : ";
			if(!length($substring))
			{
				# Set our test string from the first string in the array.  And this is
				# in its own separate if() because there's no sense in testing whether
				# this first string matches itself.
				#
				$substring = substr($_, 0, $i);

				# Also note that, because of this if() and the fact that we only set
				# the LCS variable in the following else(), that means we're technically
				# only removing length(LCS)-1 characters -- but that's what we want,
				# because otherwise we'd be leaving a null string in the event that one
				# of the strings *is* the LCS.  Instead we're leaving one character from
				# the end of the LCS as the first character on all the output strings.
			}
			else
			{
				if(/^$substring/)
				{
					#print STDERR "still matches ('$_' matches '$substring')\n";
					$longest_common_substring = $substring;
				}
				else
				{
					# failed the match, so we need to roll it back by 1 char:
					$longest_common_substring = substr($longest_common_substring, 0, -1);
					#print STDERR "failed match; we're done here. \$longest_common_substring='$longest_common_substring'\n";
					$done = 1; last;
				}
			}
			if(length($substring) >= length($_))
			{
				#print STDERR "\n\tsubstring now as long as the shortest string; we're done here\n";
				$done = 1; last;
			}
		}
		$done = 1 if $i > 100; 
	}
	s!^$longest_common_substring!! for @_;
}


sub datestring8_to_etime($$)
{
	my $d8 = shift;
	my $when = shift;
	$when = $when =~ /start/ ? 'start' : 'end';

	my ($year,$month,$day) = ($d8 =~ /^(\d{4})(\d{2})(\d{2})$/);

	my ($sec,$min,$hour);
	if($when eq 'start')
	{
		($sec,$min,$hour) = (0,0,0);
	}
	else
	{
		($sec,$min,$hour) = (59,59,23);
	}

	return timelocal($sec,$min,$hour,$day,($month - 1),$year);
}


sub num_elapsed_days_between_datestring8_dates($$)
{
	my $earlier_date = shift;
	my $later_date = shift;

	if($earlier_date !~ /^\d{8}$/ || $later_date !~ /^\d{8}$/)
	{
		die qq`$0: datestrings must contain exactly 8 digits and nothing else, but you've passed "$earlier_date" and "$later_date"\n`;
	}

	return 0 if $earlier_date == $later_date;

	if($earlier_date > $later_date)
	{
		my $temp = $earlier_date;
		$earlier_date = $later_date;
		$later_date = $temp;
	}

	# now $earlier_date is smaller/earlier than $later_date.

	my $elapsed_days = 0;
	while($earlier_date < $later_date)
	{
		$later_date = decrement_datestring_8($later_date, 1);
		$elapsed_days++;
	}

	return $elapsed_days;
}


sub increment_datestring_8($$)
{
	my $start = shift;
	my $amount = shift;
	my $i = ();

	die_nice("Error: increment_datestring_8('$start', '$amount'): invalid start date '$start'.\n") unless $start =~ /^\d{8}$/;

	for($i=1; $i<=$amount; $i++)
	{
		my ($year,$month,$day) = ($start =~ /(\d{4})(\d{2})(\d{2})/);
		my ($newmonth,$newday) = ($month,$day);

		s/^0// for($newmonth,$newday);

		# try to inc the day
		eval { timelocal(0,0,0,$newday+1,$newmonth-1,$year); }; # note: timelocal's month is 0..11 so $month-1 = $month
		if($@) # means there was an error.
		{
			# try to inc the month
			eval { timelocal(0,0,0,1,$newmonth,$year); };
			if($@)
			{
				# inc the year
				eval { timelocal(0,0,0,1,0,$year+1); };
				if($@)
				{
					die_nice("Error: increment_datestring_8('$start', '$amount'): can't increment the year: $@\n");
				}
				else
				{
					$year++;
					$start = $year . '0101';
				}
			}
			else
			{
				$newmonth++;
				$newmonth = "0$newmonth" if ($newmonth =~ /^\d$/);
				$start = $year . $newmonth . '01';
			}
		}
		else
		{
			$newday++;
			$newday = "0$newday" if ($newday =~ /^\d$/);
			$start = $year . $month . $newday;
		}
	}

	return $start;
}


sub decrement_datestring_8($$)
{
	my $start = shift;
	my $amount = shift;
	my $i = ();

	die_nice("Error: decrement_datestring_8('$start', '$amount'): invalid start date '$start'.\n") unless $start =~ /^\d{8}$/;

	for($i=1; $i<=$amount; $i++)
	{
		my ($year,$month,$day) = ($start =~ /(\d{4})(\d{2})(\d{2})/);
		my ($newmonth,$newday) = ($month,$day);

		s/^0// for($newmonth,$newday);

		# try to dec the day
		eval { timelocal(0,0,0,$newday-1,$newmonth-1,$year); }; # note: timelocal's month is 0..11 so $month-1 = $month
		if($@ || $newday !~ /[1-9]/) # $@ means there was an error.  also need to make sure $newday is nonzero for servers whose timelocal() is broken, incorrectly reporting 0 as a valid day.
		{
			# try to dec the month
			eval { timelocal(0,0,0,1,$newmonth-2,$year); };
			if($@)
			{
				# month is Jan... dec the year
				eval { timelocal(0,0,0,1,0,$year-1); };
				if($@)
				{
					die_nice("Error: decrement_datestring_8('$start', '$amount'): can't decrement the year: $@\n");
				}
				else
				{
					$year--;
					$start = $year . '1231';
				}
			}
			else
			{
				# we know the month is valid, so find the highest valid day:
				$newday = 32;
				do { $newday--; eval { timelocal(0,0,0,$newday,$newmonth-2,$year); }; } while ($@);

				$newmonth--;
				$newmonth = "0$newmonth" if ($newmonth =~ /^\d$/);
				$start = $year . $newmonth . $newday;
			}
		}
		else
		{
			$newday--;
			$newday = "0$newday" if ($newday =~ /^\d$/);
			$start = $year . $month . $newday;
		}
	}

	return $start;
}


sub increment_datestring_6
{
	my $date = shift;
	die_nice qq`Invalid datestring6 value: '$date'.` unless $date =~ /^\d{6}$/;
	my ($year,$month) = ($date =~ /(\d{4})(\d{2})/);
	$month =~ s!^0!!;
	$month++;
	if($month > 12)
	{
		$month = 1;
		$year++;
	}
	$month = "0$month" if $month =~ /^\d$/;
	return "$year$month";
}


sub decrement_datestring_6
{
	my $date = shift;
	die_nice qq`Invalid datestring6 value: '$date'.` unless $date =~ /^\d{6}$/;
	my ($year,$month) = ($date =~ /(\d{4})(\d{2})/);
	$month =~ s!^0!!;
	$month--;
	if($month < 1)
	{
		$month = 12;
		$year--;
	}
	$month = "0$month" if $month =~ /^\d$/;
	return "$year$month";
}


sub split_path_and_filename
{
	return ($_[0] =~ m!^(.*?)([^/\\]+)$!);
}


sub serialize_filename_if_file_exists
{
	my $fullfile = shift;
	my $separator = shift;		# optional
	my $paddinglength = shift || 2;	# optional

	my ($path,$file) = split_path_and_filename($fullfile);
	$separator ||= $file =~ / / ? ' ' : '_';

	my $i = my $j = 1;
	while(-e $fullfile)
	{
		$j = $i;
		$j = "0$j" while(length($j) < $paddinglength);
		my $tempname = $file;
		$tempname =~ s/(\.[^\.]+)$/$separator$j$1/;
		$fullfile = $path . $tempname;
		$i++;
	}

	return wantarray ? ($fullfile, $separator, $j) : $fullfile;
}


sub get_all_subdirs
{
	#print STDERR "get_all_subdirs('$_[0]')\n";

	my $dir = shift;
	my $mode = shift;
	unless(-d $dir)
	{
		print_http_headers();
		print qq`<p>Error: get_all_subdirs(): we need a directory, but we received "$dir".</p>\n`;
		return;
	}
	opendir(DIRHFORSUBS, $dir) or die_nice "couldn't open directory '$dir': $!\n";
	# TODO: the -w test here should be removed, since this sub is named "get_all_subdirs".  It was probably originally
	# included for the sake of FC which generally isn't interested in dirs it can't write to, but that should be handled
	# explicitly in other code, rather than silently in this general-use sub.
	my @dirs = sort { lc($a) cmp lc($b) } grep {  -d "$dir/$_"  &&  -w "$dir/$_"  &&  !/^\.$/  &&  !/^\.{2}$/  } readdir(DIRHFORSUBS);
	closedir DIRHFORSUBS or die_nice "couldn't close directory '$dir': $!\n";

	my @subdirs = ();
	# now recurse through everything below this point.
	foreach my $level1dir (@dirs)
	{
		foreach my $level2dir (get_all_subdirs("$dir/$level1dir"))
		{
			push @subdirs, "$level1dir/$level2dir";
		}
	}
	push @dirs, @subdirs;

	return sort { lc($a) cmp lc($b) } @dirs;
}


sub get_all_files
{
	my $dir = shift;
	opendir(DIRHFORFILES, $dir) or die_nice "couldn't open directory '$dir': $!\n";
	my @files = sort { lc($a) cmp lc($b) } grep {  -f "$dir/$_"  &&  -r "$dir/$_"  &&  !/^\.$/  &&  !/\.{2}/  } readdir(DIRHFORFILES);
	closedir DIRHFORFILES or die_nice "couldn't close directory '$dir': $!\n";
	return @files;
}


sub get_enc_visitor_id_iframe()
{
	return $PREF{enc_visitor_id_was_missing} ? qq`<iframe src="$ENV{SCRIPT_NAME}?action=set_enc_visitor_id&amp;newid=$PREF{enc_visitor_id}" name="enc_vis_id_setter" id="enc_vis_id_setter" width="1" height="1"></iframe>\n` : '';
}


sub set_enc_visitor_id()
{
	set_cookie($PREF{enc_visitor_id_cookie}, get_qs_var('newid'), "+365d");
	print_http_headers();
	exit;
}


sub generate_random_hash()
{
	# We're using md5_hex() here instead of enc_hash() because the latter is prefs-dependent,
	# but we need this sub to be callable before prefs are loaded; and because, for a random
	# hash, as opposed to a hash of sensitive data like a password, the issues that make MD5
	# weaker than SHA1 are irrelevant.  Also note that, because the input data will be
	# different every single time this sub is called, and thus the output hash will never be
	# the same for any two calls (which is the whole point), that means that at any point in
	# the future, we can change to a different hash function, without it breaking anything
	# (for example, if/when sha1_hex() ever becomes available on virtually every installation,
	# as md5_hex() is now).

	return md5_hex($ENV{REMOTE_ADDR} . $$ . $ENV{HTTP_USER_AGENT} . $ENV{REMOTE_PORT} . time() . rand());
}


sub get_css_std()
{
	return	  $PREF{css} . "\n\n"
		. $PREF{css_shared} . "\n\n"
		. ($PREF{default_app_style} eq 'dark' ? "$PREF{css_dark}\n$PREF{css_shared_dark}" : "$PREF{css_light}\n$PREF{css_shared_light}") . "\n\n"
		. $PREF{css_extra};
}


sub start_html_output_std
{
	return if $PREF{start_html_output_called};
	$PREF{start_html_output_called} = 1;

	my $subtitle = shift;

	print_http_headers();
	if($PREF{internal_appname} eq 'userbase') { return if $qs =~ /format=mini/; }

	my $css = get_css();
	my $js = get_js();

	$PREF{title} = $PREF{"title_$PREF{on_page}"} if exists $PREF{"title_$PREF{on_page}"};
	my $show_app_pagetitle = $PREF{"hide_app_pagetitle_on_$PREF{on_page}_page"} !~ /yes/i;
	my $show_app_subtitle  = $PREF{"hide_app_subtitle_on_$PREF{on_page}_page"} !~ /yes/i;
	my $title_for_titlebar = exists $PREF{"titlebar_title___$PREF{on_page}"} ? $PREF{"titlebar_title___$PREF{on_page}"} : exists $PREF{titlebar_title} ? $PREF{titlebar_title} : $PREF{title};
	$title_for_titlebar =~ s!%%subtitle%%!$subtitle!g;
	$title_for_titlebar =~ s!<[^>]*>!!g;

	my $body_details = qq`id="$PREF{twochar_app_id}body" class="$PREF{on_page}body $PREF{current_app_style}_style"`;

	# TODO: remove the next two lines after updating the documentation (in FAQ, etc) and the trial version to use the new ?encembed=yes method:
	# Update: disabled 20120416, in v4.86:
	#$PREF{we_are_not_embedded} = 1 if($ENV{REQUEST_METHOD} =~ /post/i   ||   $PREF{"print_full_html_tags_for_$PREF{on_page}"} =~ /yes/i   ||   ($PREF{print_full_html_tags} =~ /yes/i   &&   $PREF{"print_full_html_tags_for_$PREF{on_page}"} !~ /no/i)   ||   (get_qs_var('forcefullhtml') eq 'yes')   ||   (get_qs_var('forcefullpage') eq 'yes'));
	#$PREF{we_are_embedded} = 0 if $PREF{we_are_not_embedded};

	if($PREF{we_are_embedded})
	{
		print	  $PREF{extra_header_output};
		print	  $PREF{body_container_start} || qq`<div $body_details>\n`;
	}
	elsif($PREF{encodable_app_template_file} && -e $PREF{encodable_app_template_file})
	{
		my $title = $PREF{title_for_template_file} || $title_for_titlebar || $subtitle;
		open(HEADERFH, "<$PREF{encodable_app_template_file}") or die "$0: couldn't open \$PREF{encodable_app_template_file} ('$PREF{encodable_app_template_file}') for reading:: $!\n";
		my $infh = \*HEADERFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		flock $infh, 1;
		seek $infh, 0, 0;
		while(<$infh>)
		{
			s!%%title%%!$title!g;
			s#(<!--\s*)?%%js%%(\s*-->)?#<script type="text/javascript" src="$ENV{SCRIPT_NAME}?js"></script>#g;
			s#(<!--\s*)?%%css%%(\s*-->)?#<link rel="stylesheet" type="text/css" media="all" href="$ENV{SCRIPT_NAME}?css">#g;

			if(/^(.*?)(?:<!--\s*)?%%encodable_app_output%%/i)
			{
				print $1; last;
			}
			else
			{
				print $_;
			}
		}
		close $infh or die "$0: couldn't close \$PREF{encodable_app_template_file} ('$PREF{encodable_app_template_file}') after reading:: $!\n";

		print	  $PREF{extra_header_output};
		print	  $PREF{body_container_start} || qq`<div $body_details>\n`;
	}
	#if($ENV{REQUEST_METHOD} =~ /post/i   ||   $PREF{"print_full_html_tags_for_$PREF{on_page}"} =~ /yes/i   ||   ($PREF{print_full_html_tags} =~ /yes/i   &&   $PREF{"print_full_html_tags_for_$PREF{on_page}"} !~ /no/i)   ||   (get_qs_var('forcefullhtml') eq 'yes')   ||   (get_qs_var('forcefullpage') eq 'yes'))
	else
	{
		print	  qq`<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">`
			. qq`\n<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">`
			. qq`\n<head>`
			. qq`\n<meta http-equiv="Content-type" content="text/html; charset=UTF-8" />`
			. qq`\n<title>$title_for_titlebar</title>`
			. qq`\n<script type="text/javascript">\n/* <![CDATA[ */  /* so (X)HTML validators ignore the javascript. */\n\n$js\n\n/* ]]> */  /* so (X)HTML validators ignore the javascript. */\n</script>`
			. qq`\n<style type="text/css">$css</style>`
			. $PREF{extra_header_output}
			. qq`\n</head>`
			. qq`\n<body $body_details>`
			. qq`\n`;
	}

	$PREF{app_output_template} =~ s!%%title%%!$PREF{title}!g;
	$PREF{app_output_template} =~ s!%%subtitle%%!$subtitle ? qq`<div id="encsubtitle">$subtitle</div>` : ''!eg;
	$PREF{app_output_template} =~ s!%%%if-pagetitle%%%(.*?)%%%end-pagetitle%%%!$PREF{title} && $show_app_pagetitle ? $1 : ''!egs;
	$PREF{app_output_template} =~ s!%%%if-pagesubtitle%%%(.*?)%%%end-pagesubtitle%%%!$subtitle && $show_app_subtitle ? $1 : ''!egs;
	$PREF{app_output_template} =~ s!%%on_page%%!$PREF{on_page}!g;
	$PREF{app_output_template} =~ s!%%wide_page_css_wrapper_id%%!$PREF{on_a_wide_page} ? "$PREF{twochar_app_id}wrapper_widepage" : ''!egs;
	$PREF{app_output_template} =~ s!%%%if-onpage_(\w+)%%%(.*?)%%%endif-onpage_\1%%%!$PREF{on_page} eq $1 ? $2 : ''!egs;
	$PREF{app_output_template} =~ s!%%%ifelse-onpage_(\w+)%%%(.*?)%%%else%%%(.*?)%%%endelse-onpage_\1%%%!$PREF{on_page} eq $1 ? $2 : $3!egs;
	do_standard_template_vars_processing('include_undefined', $PREF{app_output_template});

	my $output_tophalf = ($PREF{app_output_template} =~ /(.*)%%app_output_body%%/s)[0];
	my $linkbar = get_linkbar(@_);
	$output_tophalf =~ s!%%linkbar_top%%!$linkbar!g;
	print $output_tophalf;

	if($PREF{internal_appname} eq 'userbase')
	{
		print_admin_toolbar(); if(-e $PREF{default_account_temp_file}) { print qq`<div style="margin: 20px auto; max-width: 400px;">To determine your default admin account, login to your server via your normal method (FTP, etc) and then read the file $PREF{default_account_temp_file} (within your cgi-bin folder or login folder by default).&nbsp; This message will be displayed until you delete that file.</div>\n`; }
	}
}


sub finish_html_output_std
{
	return if $PREF{finish_html_output_called};
	$PREF{finish_html_output_called} = 1;

	if($PREF{internal_appname} eq 'userbase') { return if $qs =~ /format=mini/; }

	my $linkbar = get_linkbar(@_);
	my $output_bottomhalf = ($PREF{app_output_template} =~ /%%app_output_body%%(.*)/s)[0];
	$output_bottomhalf =~ s!%%linkbar_bottom%%!$linkbar!g;
	$output_bottomhalf =~ s!%%powered_by%%!$PREF{hide_poweredby} eq 'yes' ? '' : get_powered_by()!eg;
	print $output_bottomhalf;

	if($PREF{enable_debug} =~ /yes/i)
	{
		print qq`<div style="margin: 20px auto; min-width: 400px; max-width: 600px; padding: 5px; background: #fff; color: #444; border: 1px solid #999;">`
			. qq`Warning: you've set \$PREF{enable_debug} to 'yes'.&nbsp; If you're not having problems, you should disable this.&nbsp; And if you are having problems, you should still disable this, because in some cases it can cause features not to work.&nbsp; Only enable this temporarily.`
			. qq`\n</div>\n`;
	}

	if(($CGI::VERSION < 3.03)   &&   ($PREF{ignore_ancient_CGI_module} !~ /yes/i))
	{
		print qq`<div style="margin: 20px auto; min-width: 400px; max-width: 600px; padding: 5px; background: #fff; color: #444; border: 1px solid #999;">`
			. qq`Warning: your server's version of the CGI.pm Perl module is $CGI::VERSION, which is extremely outdated.&nbsp; `
			. qq`Some features like uploading may not work at all, or may be unreliable.&nbsp; To fix this, `
			. qq`<a href="http://encodable.com/sharedfaq/#oldcgi" target="_blank">update your CGI module</a>.&nbsp; `
			. qq`To ignore this problem (not recommended), add this line to the end of your prefs file: `
			. qq`\$PREF{ignore_ancient_CGI_module}='yes';</div>\n`;
	}

	print get_enc_visitor_id_iframe();
	send_event_calendar_reminders() if $PREF{internal_appname} eq 'userbase';
	print get_extra_debug_output();

	if($PREF{we_are_embedded})
	{
		print	  $PREF{body_container_end} || qq`</div><!-- end #$PREF{twochar_app_id}body -->\n`;
		print	  $PREF{extra_footer_output};
	}
	elsif($PREF{encodable_app_template_file} && -e $PREF{encodable_app_template_file})
	{
		print	  $PREF{body_container_end} || qq`</div><!-- end #$PREF{twochar_app_id}body -->\n`;
		print	  $PREF{extra_footer_output};

		open(FOOTERFH, "<$PREF{encodable_app_template_file}") or die "$0: couldn't open \$PREF{encodable_app_template_file} ('$PREF{encodable_app_template_file}') for reading:: $!\n";
		my $infh = \*FOOTERFH; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		flock $infh, 1;
		seek $infh, 0, 0;
		my $found_token = 0;
		while(<$infh>)
		{
			if($found_token)					{ print $_; }
			elsif(/%%encodable_app_output%%(?:\s*-->)?(.*?)$/i)	{ print $1; $found_token = 1; }
		}
		close $infh or die "$0: couldn't close \$PREF{encodable_app_template_file} ('$PREF{encodable_app_template_file}') after reading:: $!\n";
	}
	#if($ENV{REQUEST_METHOD} =~ /post/i   ||   $PREF{"print_full_html_tags_for_$PREF{on_page}"} =~ /yes/i   ||   ($PREF{print_full_html_tags} =~ /yes/i   &&   $PREF{"print_full_html_tags_for_$PREF{on_page}"} !~ /no/i)   ||   (get_qs_var('forcefullhtml') eq 'yes')   ||   (get_qs_var('forcefullpage') eq 'yes'))
	else
	{
		print	  $PREF{extra_footer_output};
		print	  qq`</body>\n</html>\n`;
	}
}


sub check_image_modules
{
	exit_with_needprivs() unless user_is_allowed_to('view_administration_page');

	my $separator = qq`<br /><br /><hr><br />\n`;

	start_html_output("Check Image Modules");
	print qq`\n<div style="text-align: left; margin: 30px auto;">$PREF{internal_appname_nice} uses image modules in order to enable image-based features like rotation, resizing/thumbnails, etc.&nbsp; It supports 3 different methods for this: the GD Perl module, the ImageMagick Perl module, and the ImageMagick convert/identify commands; and usually only one of these is necessary.&nbsp; This page will show whether your server supports these modules.&nbsp; See <a href="http://encodable.com/filechucker/faq/#image">this FAQ</a> for more details.$separator`;

	unless($PREF{already_tested_for_im})
	{
		eval { require Image::Magick; }; $PREF{imagemagick_error} = $@;
	}
	unless($PREF{already_tested_for_gd})
	{
		eval { require GD; require GD::Simple; }; $PREF{gd_error} = $@;
	}
	foreach my $module ('ImageMagick', 'GD')
	{
		my $error = $PREF{lc($module) . "_error"};
		print qq`Attempting to load the $module Perl module... `;
		print !$error	? qq`success.`
			: qq`failed.&nbsp; The error was: <div style="margin: 20px 40px;">$error</div>`
			. qq`This means that <strong>the $module Perl module is not installed, or not installed <em>properly</em>, on your server</strong>.&nbsp; `
			. qq`This is a server error, not a $PREF{internal_appname_nice} error.&nbsp; <a href="http://encodable.com/filechucker/faq/#image">This FAQ</a> may help, `
			. qq`but you'll need to contact your hosting company if you want to get the $module Perl module installed properly.&nbsp; Or, if you have `
			. qq`root/Administrator access to your server, then we may be able to install it for you; the cost is typically 1 hour of labor.&nbsp; `
			. qq`<a href="http://encodable.com/contact/">Contact us</a> if you'd like us to look into this.`;
		print $separator;
	}

	print "Attempting to locate a 'convert' command:<br />\n";
	print "\nExecuting 'which convert': ";
	my $which_output = `which convert`;
	print $which_output && $which_output !~ /no convert in/ ? "found one or more convert commands: $which_output" : "command produced no output; no 'convert' in PATH.";
	print "<br />\n";
	print "Manually checking /usr/bin/convert: " . (-e '/usr/bin/convert' ? 'exists.' : 'does not exist.') . "<br />\n";
	print "Manually checking /usr/local/bin/convert: " . (-e '/usr/local/bin/convert' ? 'exists.' : 'does not exist.') . "<br />\n";
	print "<br />\nIf a convert command was found here, you can set \$PREF{convert_command} to it, and then enable the \$PREF{try_to_use_convert_*} settings (and probably also the \$PREF{try_to_use_identify_*} settings because an identify command probably exists in the same location).\n";
	#print "\nExecuting 'find / -name convert':<br />\n";
	#print `find / -name convert -type f`;
	print $separator;

	if($PREF{im_and_gd_disabled_internally})
	{
		print qq`Because neither the ImageMagick nor GD Perl modules are properly installed on your server, $PREF{internal_appname_nice} has internally disabled the \$PREF{try_to_use_*} prefs for them.&nbsp; You may be able to use the \$PREF{try_to_use_convert_*} settings instead.&nbsp; See <a href="http://encodable.com/filechucker/faq/#image">this FAQ</a> for more details.$separator`;
	}

	print qq`Note that this only affects the image-based features like rotation, thumbnails, etc.&nbsp; It does not affect $PREF{internal_appname_nice}'s core functionality.&nbsp; So $PREF{internal_appname_nice} itself will work just fine even if your server does not support these image modules.`;
	print qq`</div>\n`;

	finish_html_output();
}


sub try_to_load_image_modules()
{
	# TODO: find a reliable way to test whether the jpegtran and convert binaries are available.
	# For now, just hardcode the $PREF{(jpegtran|convert)_available} = 'yes'; and use the try_to_*
	# PREF to switch it off.
	#
	#if(!jpegtran_is_available()   &&   ($PREF{try_to_use_jpegtran_for_rotation} =~ /yes/i))
	#{
	#	die_nice qq`$PREF{internal_appname}: jpegtran is not available on your server, so you must either install it, or else disable the following setting in PREFs Section 15: <br /><br />\n\$PREF{try_to_use_jpegtran_for_rotation}`;
	#}
	$PREF{jpegtran_available} = 'yes';
	$PREF{convert_available} = 'yes';
	$PREF{identify_available} = 'yes';

	# Note: the call to *_is_available() MUST come last in these if()s, so that on
	# servers where the module is corrupt, we can prevent even trying to load it,
	# by setting the PREFs to 'no'.
	#
	my $tried_im_and_failed = 1 if(($PREF{try_to_use_imagemagick_for_rotation} =~ /yes/i || $PREF{try_to_use_imagemagick_for_resizing} =~ /yes/i || $PREF{try_to_use_imagemagick_for_humantest} =~ /yes/i)   &&   !imagemagick_is_available());
	my $tried_gd_and_failed = 1 if(($PREF{try_to_use_gd_for_rotation} =~ /yes/i || $PREF{try_to_use_gd_for_resizing} =~ /yes/i || $PREF{try_to_use_gd_for_humantest} =~ /yes/i)   &&   !gd_is_available());
	if($tried_im_and_failed   &&   $tried_gd_and_failed)
	{
		$PREF{im_and_gd_disabled_internally} = 1;
		foreach my $pref (keys %PREF) { $PREF{$pref} = 'no' if $pref =~ /^try_to_use_(imagemagick|gd)/i; }
	}
}

sub jpegtran_is_available()
{
	$PREF{jpegtran_test_command} = 'jpegtran </dev/null >/dev/null 2>&1';
	my ($success,$msg) = enc_sys_call($PREF{jpegtran_test_command});
	if($success)	{ $PREF{jpegtran_available} = 'yes';	$PREF{jpegtran_error} = ''; }
	else		{ $PREF{jpegtran_available} = 'no';	$PREF{jpegtran_error} = "Failed to execute jpegtran: $msg"; }
	return !$PREF{jpegtran_error};
}


sub imagemagick_is_available()
{
	unless($PREF{already_tested_for_im})
	{
		$PREF{already_tested_for_im} = 1;
		eval { require Image::Magick; }; $PREF{imagemagick_error} = $@;
		$PREF{imagemagick_available} = !$PREF{imagemagick_error};
	}
	return $PREF{imagemagick_available};
}


sub gd_is_available()
{
	unless($PREF{already_tested_for_gd})
	{
		$PREF{already_tested_for_gd} = 1;
		eval { require GD; require GD::Simple; }; $PREF{gd_error} = $@;
		$PREF{gd_available} = !$PREF{gd_error};
	}
	return $PREF{gd_available};
}


sub do_automatic_resizing($)
{
	my $files = shift;
	# hashref, formatted like this:
	# $$files{01}{name} = 'foo.jpg',
	# $$files{01}{realpath} = '/full/path/to/imagedir',
	# $$files{01}{force_overwrite} = 1 (optional).

	my @results = ();
	my $filecount = scalar keys %$files;

	if($PREF{resize_uploaded_images} =~ /yes/i   ||   $PREF{create_resized_copies_of_uploaded_images} =~ /yes/i)
	{
		foreach my $pref (sort keys %PREF)
		{
			if($pref =~ /^create_resized_copies_(\d+)__imagemagick_size$/)
			{
				my $num = $1;
				foreach my $file (sort keys %$files)
				{
					if(is_image($$files{$file}{name}))
					{
						my $file_id_for_status = $filecount == 1 ? $$files{$file}{name} : "#$file ($$files{$file}{name})";

						my $input_file_full = $$files{$file}{realpath} . '/' . $$files{$file}{name};
						condense_slashes('leave_leading_UNC', $input_file_full);

						if($PREF{create_resized_copies_of_uploaded_images} =~ /yes/i)
						{
							my $smallsize = ($PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_resizing} =~ /yes/i) || $PREF{try_to_use_convert_for_resizing} =~ /yes/i ? $PREF{"create_resized_copies_${num}__imagemagick_size"} : gd_is_available() ? $PREF{"create_resized_copies_${num}__gd_size"} : '';

							if(-s $input_file_full > $PREF{"create_resized_copies_${num}__skip_if_bigger_than"})
							{
								push @results, qq`Creating ${smallsize}px resized copy of $file_id_for_status: skipping because input file is bigger than the limit ($PREF{"create_resized_copies_${num}__skip_if_bigger_than"} bytes).`;
								next;
							}

							my $output_dir = $PREF{"create_resized_copies_${num}__location_type"} eq 'absolute' ? $PREF{"create_resized_copies_${num}__folder_name"} : $$files{$file}{realpath};
							$output_dir .= '/' . $PREF{"create_resized_copies_${num}__folder_name"} if $PREF{"create_resized_copies_${num}__folder_name"} && $PREF{"create_resized_copies_${num}__location_type"} eq 'relative';
							condense_slashes('leave_leading_UNC', $output_dir);
							create_dir_if_DNE($output_dir,$PREF{writable_dir_perms});

							my $output_file = $PREF{"create_resized_copies_${num}__new_filename"};
							my ($origname,$ext) = ($$files{$file}{name} =~ /(.+)\.(.+)/);
							$output_file =~ s!%%orig%%!$origname!g;
							$output_file =~ s!%%ext%%!$ext!g;

							my $output_file_full = $output_dir . '/' . $output_file;
							#unless($PREF{overwrite_existing_files} =~ /yes/i)
							if($PREF{"create_resized_copies_${num}__serialize_or_overwrite"} eq 'serialize')
							{
								$output_file_full = serialize_filename_if_file_exists($output_file_full);
							}

							# Make sure to do the skip-if-exists check before the image-dims check, because
							# the latter is expensive.
							#
							if(-e $output_file_full && !$$files{$file}{force_overwrite})
							{
								push @results, qq`Creating ${smallsize}px resized copy of $file_id_for_status: skipping because output file already exists.`;
								next;
							}

							my ($origw,$origh) = get_image_dims($input_file_full);
							my ($thumbw,$thumbh) = ($smallsize =~ /^(\d*)x?(\d*)$/i);
							if($origw > $thumbw || $origh > $thumbh || !$origw || !$thumbw)
							{
								#resize_image($input_file_full, $output_file_full, $smallsize);
								resize_image___withtimeout($PREF{image_resizing_timeout}, $input_file_full, $output_file_full, $smallsize);
								push @results, qq`Creating ${smallsize}px resized copy of $file_id_for_status: OK.` if -e $output_file_full;
								push @results, qq`Creating ${smallsize}px resized copy of $file_id_for_status: failed (output file does not exist afterwards).` unless -e $output_file_full;
							}
							else
							{
								copy($input_file_full, $output_file_full) or die_nice "couldn't copy image file '$input_file_full' to thumbnail file '$output_file_full': $!\n";
								push @results, qq`Creating ${smallsize}px resized copy of $file_id_for_status: OK (copied from original because original was already small enough).` if -e $output_file_full;
								push @results, qq`Creating ${smallsize}px resized copy of $file_id_for_status: failed (tried to copy from original because original was already small enough).` unless -e $output_file_full;
							}
							chmod $PREF{writable_file_perms}, $output_file_full;
						}

						if($PREF{resize_uploaded_images} =~ /yes/i)
						{
							next if -s $input_file_full > $PREF{resize_uploaded_images__skip_if_bigger_than};

							my $smallsize = ($PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_resizing} =~ /yes/i) || $PREF{try_to_use_convert_for_resizing} =~ /yes/i ? $PREF{resize_uploaded_images__imagemagick_size} : gd_is_available() ? $PREF{resize_uploaded_images__gd_size} : '';
							my ($origw,$origh) = get_image_dims($input_file_full);
							my ($thumbw,$thumbh) = ($smallsize =~ /^(\d*)x?(\d*)$/i);
							if($origw > $thumbw || $origh > $thumbh || !$origw || !$thumbw)
							{
								#resize_image($input_file_full, $input_file_full, $smallsize);
								resize_image___withtimeout($PREF{image_resizing_timeout}, $input_file_full, $input_file_full, $smallsize);
								push @results, qq`Resizing $file_id_for_status to ${smallsize}px: OK.` if -e $input_file_full;
								chmod $PREF{writable_file_perms}, $input_file_full;
							}
						}
					}
				}
			}
		}
	}

	return @results;
}


sub get_image_dims
{
	my $filename = shift;
	my ($width, $height, $xres, $yres) = ();
	my $decpoints = $PREF{num_decimal_points_for_image_details} =~ /^(\d+)$/ ? $1 : 2;
	if($PREF{identify_available} =~ /yes/i && $PREF{try_to_use_identify_for_dimensions} =~ /yes/i)
	{
		my $info = `$PREF{identify_command} -verbose "$filename"`;
		($width,$height) = ($1,$2) if $info =~ /^\s*Geometry:\s*(\d+)x(\d+)/m;
		($xres,$yres) = ($1,$2) if $info =~ /^\s*Resolution:\s*(\d+)x(\d+)/m;

		# This works, and doesn't require reading the whole image into memory so it's
		# quicker, but it can only get a few image attributes, not all of them.
		#
		#my $info = `$PREF{identify_command} "$filename"`;
		#($width,$height) = ($1,$2) if $info =~ /^$filename [A-Z]+ (\d+)x(\d+) /   ||   $info =~ /^$filename [A-Z]+ (\d+)x(\d+)\+\d+\+\d+ /;
	}
	elsif($PREF{imagemagick_available} && $PREF{try_to_use_imagemagick_for_dimensions} =~ /yes/i)
	{
		my $image = new Image::Magick;
		my $x = $image->Read($filename);
		#die_nice "ImageMagick Read() error: $x" if "$x"; # seems to die too easily, i.e. for unknown meta tags in an otherwise OK image.
		($width, $height, $xres, $yres) = $image->Get('width', 'height', 'x-resolution', 'y-resolution');

		# This works, and doesn't require reading the whole image into memory so it's
		# quicker, but it can only get a few image attributes, not all of them.
		#
		#my $image = new Image::Magick;
		#my ($width, $height, $size, $format) = $image->Ping($filename);
		#return ($width, $height);

		# This works, but the output goes directly to STDOUT/STDERR instead of into @details.
		#
		#my $image = new Image::Magick;
		#my $x = $image->Read($filename);
		#die_nice "ImageMagick Read() error: $x" if "$x";
		#my @details = $image->Identify();
		##die_nice (qq`Details: \n<br />` . join("\n<br /><br />", @details));
	}
	elsif(gd_is_available() && $PREF{try_to_use_gd_for_dimensions} =~ /yes/i)
	{
		my $image = GD::Image->new($filename);
		($width,$height) = ($image->width, $image->height) if $image;
	}

	my $width_inches  = $width  && $xres ? $width/$xres  : '';
	my $height_inches = $height && $yres ? $height/$yres : '';

	for($xres, $yres, $width_inches, $height_inches)
	{
		s!(\.\d{$decpoints}).+!$1!; $_ = int($_) unless $decpoints;
	}

	return ($width, $height, $xres, $yres, $width_inches, $height_inches);
}


sub resize_image___withtimeout
{
	my $timeout = shift;
	my $ignore_other_errors	= $_[0] eq 'ignore_other_errors' ? shift : '';
	my $timeouts_are_errors	= $_[0] eq 'timeouts_are_errors' ? shift : '';

	#use Time::HiRes 'gettimeofday';
	#my $starttime = gettimeofday();

	if($timeout)
	{
		if(0) # eval method: (doesn't always work; for exaple with timeout set to 8, a certain image still takes 100+ seconds??)
		{
			eval {
				local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required
				alarm $timeout;
				resize_image(@_);
				alarm 0;
			};
			if($@)
			{
				if($@ eq "alarm\n")	{ $timeouts_are_errors	&& die_nice("Timed out while trying to resize image.\n");	} # timed out.
				else			{ $ignore_other_errors	|| die_nice("Error while trying to resize image: $@\n");	} # propagate unexpected errors.
			}
			# else it didn't time out.
		}
		else # fork method:
		{
			my $pid = fork;
			defined $pid or die_nice "Could not fork: $!\n";
			unless ($pid) {
				# child:
				local $SIG{ALRM} = 'DEFAULT';
				alarm $timeout;
				resize_image(@_);
				alarm 0;
				exit; # exit the child.
			}
			waitpid $pid, 0;
		}
	}
	else { resize_image(@_); }

	#print STDERR "resize_image___withtimeout: timeout set to $timeout; actual time was " . int(gettimeofday() - $starttime) . "\n";
}


sub resize_image
{
	my $infile = shift;
	my $outfile = shift;
	my $newW = shift;
	my $newH = shift;

	return unless -s $infile;

	my $geom = ();
	if($newW =~ /(\d*)x(\d*)!?/i)
	{
		$geom = $newW;
		($newW,$newH) = ($1,$2);
	}
	else
	{
		$geom = $newW . 'x' . $newH;
	}

	unless($newW =~ /[1-9]/ || $newH =~ /[1-9]/)
	{
		my $errormsg = "can't resize image because at least one of the dimensions must be specified (\$newW='$newW', \$newH='$newH')\n";
		encdebug $errormsg;
		exit_with_error $errormsg if $PREF{ignore_image_resizing_errors} !~ /yes/i;
		return;
	}

	if($PREF{convert_available} =~ /yes/i   &&   $PREF{try_to_use_convert_for_resizing} =~ /yes/i)
	{
		#printd qq`resize_image(): using convert\n`;

		my $cmd = $PREF{convert_resize_template};
		$cmd =~ s!%%size%%!${newW}x${newH}!g;
		$cmd =~ s!%%infile%%!$infile!g;
		$cmd =~ s!%%outfile%%!$outfile!g;
		my ($success,$msg) = enc_sys_call($cmd);
		unless($success) { die_nice(qq`failed: $msg`); }
	}
	elsif($PREF{imagemagick_available}   &&   $PREF{try_to_use_imagemagick_for_resizing} =~ /yes/i)
	{
		#printd qq`resize_image(): using IM\n`;

		my $image = new Image::Magick;
		my $retval = ();

		$retval = $image->Read($infile);
		if($retval)	{ printd "error: \$image->Read()   returned $retval.\n"; return;	}

		$retval = $image->Resize(geometry=>$geom, filter=>'Lanczos');
		if($retval)	{ printd "error: \$image->Resize() returned $retval.\n"; return;	}

		$image->Set(quality=>95);
		$image->Write($outfile);
	}
	elsif(gd_is_available()   &&   $PREF{try_to_use_gd_for_resizing} =~ /yes/i)
	{
		#printd qq`resize_image(): using GD\n`;

		my $inputimage = GD::Image->new($infile);
		if(!$inputimage)	{ printd "error: GD::Image->new($infile) returned null...\n"; return;	}

		my $oldW = $inputimage->width;
		my $oldH = $inputimage->height;

		die "$0: can't resize image because a dimension is missing (\$oldW='$oldW', \$oldH='$oldH')\n" unless $oldW =~ /[1-9]/ && $oldH =~ /[1-9]/;

		if(!$newW)
		{
			$newW = ($newH * $oldW) / $oldH;
			$newW =~ s/\..*//;
		}
		if(!$newH)
		{
			$newH = ($newW * $oldH) / $oldW;
			$newH =~ s/\..*//;
		}

		my $outputimage = GD::Image->newTrueColor($newW,$newH);
		$outputimage->copyResampled($inputimage,0,0,0,0,$newW,$newH,$oldW,$oldH);
		open(RESIMG, ">$outfile") or die "$0: couldn't create file '$outfile': $!\n";
		my $fh = \*RESIMG; # voodoo required since ancient Perls can't accept "open(my $foo_fh)".
		binmode $fh;
		   if($outfile =~ /\.jpe?g$/i)	{ print $fh $outputimage->jpeg(95);	}
		elsif($outfile =~ /\.png$/i)	{ print $fh $outputimage->png(3);	}
		elsif($outfile =~ /\.gif$/i)	{ print $fh $outputimage->gif();	}
		else				{ die "$0: resize_image(): image format not supported by GD.\n"; }
		close $fh or die "$0: couldn't close file '$outfile' after creating it: $!\n";
	}
	else
	{
		die_nice "no image-resizing library available.";
	}

	my $errormsg = qq`Output file does not exist after resizing; try adjusting or disabling \$PREF{image_resizing_timeout} and other image/video timeouts.`;
	encdebug $errormsg;
	exit_with_error $errormsg if (!-f $outfile) && ($PREF{ignore_image_resizing_errors} !~ /yes/i);
}


sub image_orientation_is_resettable($)
{
	my $filename = shift;
	return 0 unless $filename =~ /\.(jpg|jpe|jpeg)$/i;
	return command_is_available("exiftool") || command_is_available("exifautotran");
}


sub reset_image_orientation($)
{
	my $filename_with_path = shift;
	exit_with_error qq`file doesn't exist: '$filename_with_path'.` unless -e $filename_with_path;
	if(command_is_available("exiftool"))
	{
		system("exiftool -q -n -P -Orientation=1 \"$filename_with_path\"");
	}
	elsif(command_is_available("exifautotran"))
	{
		system("exifautotran \"$filename_with_path\"");
	}
	else
	{
		exit_with_error qq`no image-orientation-resetting program available.`;
	}
	chmod $PREF{writable_file_perms}, $filename_with_path;
}


# Prereqs: the passed command must be *just* a command; it must
# not contain any arguments.  (But because of systems with dumb
# setups (i.e. Windows), the command may still contain spaces.)
# The reason is that we'll actually execute whatever command is
# passed in, so including arguments on it will make the command
# actually do stuff, as opposed to just executing and quitting,
# as most commands will do when no arg is passed.
#
sub command_is_available($)
{
	my $cmd = shift;
	my $retval = $^O =~ /MSWin/ ? system("$cmd >NUL 2>NUL") : system("$cmd >/dev/null 2>&1");
	my $failed = 0;
	$failed = 1 if $? == -1;
	#$failed = 1 if $? & 127;
	$failed = 1 if $retval != 0;
	return $failed ? 0 : 1;
}


sub it_is_time_for_periodic_task($)
{
	# Usage: create a task in your prefs like this:
	#
	#	$PREF{periodic_tasks}{01}{name}		= 'some_task';
	#	$PREF{periodic_tasks}{01}{enabled}	= 'yes';
	#	$PREF{periodic_tasks}{01}{period}	= 60*10; # in seconds.
	#
	# Then in the code, do this:
	#
	#	do_the_some_task_function() if it_is_time_for_periodic_task('some_task');

	my $taskname = shift;
	my $period = '';
	my $enabled = 0;
	foreach my $i (sort { $a <=> $b } keys %{$PREF{periodic_tasks}})
	{
		if($PREF{periodic_tasks}{$i}{name} eq $taskname)
		{
			$period = $PREF{periodic_tasks}{$i}{period};
			$enabled = $PREF{periodic_tasks}{$i}{enabled} =~ /yes/i;
		}
	}
	return unless $taskname && $enabled;
	exit_with_error qq`Error: missing or invalid period setting for periodic task "$taskname".  You must create a \$PREF{periodic_tasks}{NN}{period} setting, and set it to a number, indicating the number of seconds to wait between executions of this particular task.` unless $period =~ /^\d+$/;

	my $taskslist = $PREF{datadir} . "/periodic_tasks_log.cgi";
	create_file_if_DNE($taskslist, $PREF{writable_file_perms});
	open(my $iofh, "+<$taskslist") or die_nice qq`couldn't open taskslist file '$taskslist' for I/O: $!`;
	flock $iofh, 2;
	seek $iofh, 0, 0;
	my @contents = ();
	my $time_of_last_execution = '';
	while(<$iofh>)
	{
		chomp;
		if(/^(\d+):$taskname$/)
		{
			$time_of_last_execution = $1;
		}
		else
		{
			push @contents, "$_\n";
		}
	}

	my $it_is_time = 0;
	if(!$time_of_last_execution)
	{
		$it_is_time = 1;
		push (@contents, offsettime() . ":" . $taskname . "\n");
		seek $iofh, 0, 0; print $iofh @contents; truncate $iofh, tell $iofh;
		encdebug qq`This task has never been executed before, so it IS time for task $taskname.`;
	}
	elsif((offsettime() - $time_of_last_execution) > $period)
	{
		$it_is_time = 1;
		push (@contents, offsettime() . ":" . $taskname . "\n");
		seek $iofh, 0, 0; print $iofh @contents; truncate $iofh, tell $iofh;
		encdebug qq`offsettime() - $time_of_last_execution = ` . (offsettime() - $time_of_last_execution) . qq`, which exceeds the period of $period, so it IS time for task $taskname.`;
	}
	else
	{
		encdebug qq`offsettime() - $time_of_last_execution = ` . (offsettime() - $time_of_last_execution) . qq`, which is less than $period, so it is not time for task $taskname.`;
	}

	close $iofh or die_nice qq`couldn't close taskslist file '$taskslist' after I/O: $!`;

	return $it_is_time;
}


$PREF{regerr} = sub
{
	exit_with_error qq`Registration error: $PREF{internal_appname_nice} must be installed on the registered domain, as stated in your license email.&nbsp; If you'd like to change your registered domain, please <a href="http://encodable.com/contact/" target="_blank">contact us</a> and include your old and new domains along with your license number.`;
};


sub cat($)
{
	my $file = shift;
	open(my $infh, $file) or die_nice "couldn't open file '$file' for reading: $!\n";
	flock $infh, 1;
	seek $infh, 0, 0;
	my $contents = '';
	while(<$infh>) { $contents .= $_; }
	close $infh or die_nice "couldn't close file '$file' after reading: $!\n";
	return $contents;
}


##############################################################################
### Login-FC: ################################################################
##############################################################################


sub do_login
{
	if($PREF{internal_appname} eq 'userbase')
	{
		$PREF{admin_is_logged_in} = 0;
		$PREF{member_is_logged_in} = 0;

		# Get the user's inputted username and password:
		my $input_username	= param($PREF{userbase_user_fieldname}) || ($PREF{on_failed_login_redirect_to} ? enc_redirect($PREF{on_failed_login_redirect_to}) : exit_with_error($TEXT{empty_username_error}));
		my $input_password	= param($PREF{userbase_pass_fieldname}) || ($PREF{on_failed_login_redirect_to} ? enc_redirect($PREF{on_failed_login_redirect_to}) : exit_with_error($TEXT{empty_password_error}));
		my $ref = param("ref");
		my ($expiry) = ();

		$input_username = lc($input_username) if $PREF{make_usernames_case_insensitive} =~ /yes/i && $PREF{make_case_insensitive_usernames_uppercase} !~ /yes/i;
		$input_username = uc($input_username) if $PREF{make_usernames_case_insensitive} =~ /yes/i && $PREF{make_case_insensitive_usernames_uppercase} =~ /yes/i;

		if(param("remember_me") eq "on")
		{
			if($PREF{num_days_rememberme_cookie_lasts} !~ /^\d+$/)
			{
				$PREF{num_days_rememberme_cookie_lasts} = 7;
			}
			$expiry = "+$PREF{num_days_rememberme_cookie_lasts}d";
		}

		my $restrict_ip = (   ($PREF{enable_ip_address_restriction} =~ /yes/i && param("restrict_ip") =~ /on/i)   ||   ($PREF{force_ip_address_restriction} =~ /yes/i)   ) ? 1 : 0;
		$restrict_ip = 0 if $ENV{HTTP_USER_AGENT} =~ /AOL/ && $PREF{disable_ip_restriction_for_AOL_users} =~ /yes/i;

		# Get the crypted version of the input password:
		check_username_for_sql_safeness($input_username);
		my $salt = enc_sql_select("SELECT `salt` FROM `$PREF{user_table}` WHERE `username` = '$input_username';");


		# TODO: remove this if/else, and assume that !$salt is an error condition; but
		# not until around mid-2007 to give clients time to get switched over.
		#
		my ($crypted_input_password, $update_this_account_to_new_pw_system) = ();
		if(!$salt) # old version of UB that's pre-salt, so re-create the password hash and update it in the DB.
		{
			$crypted_input_password = md5_hex($input_password);
			$update_this_account_to_new_pw_system = 1;
		}
		else
		{
			$crypted_input_password = salt_and_crypt_password($input_password, $salt);
		}


		my $account_locked = enc_sql_select("SELECT `acct_locked` FROM `$PREF{user_table}` WHERE `username` = '$input_username';");
		if($account_locked)
		{
			my $lock_expired = ! account_exceeds_failed_login_limit($input_username);
			if($PREF{lock_expires_automatically} =~ /yes/i   &&   $lock_expired)
			{
				my $success = enc_sql_update("UPDATE `$PREF{user_table}` SET `acct_locked` = FALSE WHERE `username` = '$input_username';");
				die_nice("Error: do_login(input_username='$input_username'): SQL returned '$success' instead of '1' while updating acct_locked.") unless $success == 1;
			}
			else
			{
				sleep $PREF{num_seconds_to_sleep_on_failed_login};
				enc_redirect("$PREF{login_url}?phase=eacctlck");
			}
		}


		my $go = '';
		if(account_exists($input_username, $crypted_input_password, 'new_login'))
		{
			if(enc_sql_select("SELECT `acct_disabled` FROM `$PREF{user_table}` WHERE `username` = '$input_username';"))
			{
				enc_redirect("$PREF{login_url}?phase=eacctdis");
			}

			$PREF{member_is_logged_in} = 1; # technically true, but can still be revoked by later tests.
			$PREF{logged_in_userid} = my $userid = get_user_id($input_username);

			enc_redirect("$PREF{login_url}?phase=eacctpndvrf&uid=$userid&user=$input_username") if account_is_pending_email_verification($PREF{logged_in_userid});
			enc_redirect("$PREF{login_url}?phase=eacctpndpmt&uid=$userid") if account_is_pending_payment($PREF{logged_in_userid});
			enc_redirect("$PREF{login_url}?phase=eacctpndadm") if account_is_pending_admin_approval($PREF{logged_in_userid});

			my $session_id = create_new_session_id($input_username, $crypted_input_password);
			if(my $shared_session_id = check_for_multiple_logins($userid, $input_username))
			{
				$session_id = $shared_session_id;
			}
			update_loggedin_count_for_this_user($userid);

			set_cookie($PREF{site_session_cookie}, $session_id, $expiry);

			if($update_this_account_to_new_pw_system)
			{
				my $salt = create_random_salt($PREF{salt_length});
				my $new_crypted_password = salt_and_crypt_password($input_password, $salt);
				my $success = enc_sql_update("UPDATE `$PREF{user_table}` SET `password` = '$new_crypted_password', `salt` = '$salt' WHERE `id` = $userid;");
				die_nice("Error: do_login(): SQL returned '$success' instead of '1' while updating pw and creating salt.") unless $success == 1;
				$crypted_input_password = $new_crypted_password;
			}

			unless(enc_sql_select("SELECT `failed_logins` FROM `$PREF{user_table}` WHERE `id` = $userid;") eq '')
			{
				my $statement = "UPDATE `$PREF{user_table}` SET `failed_logins` = NULL WHERE `id` = $userid;";
				my $success = enc_sql_update($statement);
				die_nice("Error: do_login(id='$userid'): SQL returned '$success' instead of '1' while updating failed_logins.  SQL was: [[$statement]]") unless $success == 1;
			}

			log_user_into_db($userid, $session_id, offsettime(), $restrict_ip);
			update_logins_table($userid, $session_id);
			$PREF{admin_is_logged_in} = is_admin($PREF{logged_in_userid});

			send_login_notification_email($userid, $input_username);

			my %REDIRS = ();
			if(force_pw_change($userid))
			{
				$REDIRS{force_pw_change} = $PREF{login_url_qsready} . "action=edituser&id=$userid";
			}
			if(   (my $return = param('loginreturn'))   &&   $PREF{loginreturn}{ param('loginreturn') }   )
			{
				$REDIRS{loginreturn} = $PREF{loginreturn}{$return};
			}
			foreach my $pref (sort keys %PREF)
			{
				if($pref =~ /^on_(.+?)_login_redirect_to$/i)
				{
					my $group = $1;
					if(   user_is_member_of_group($PREF{logged_in_userid}, $group)   &&   $PREF{$pref}   &&   !($PREF{admin_is_logged_in} && ($group eq $PREF{member_group_name}))   )
					{
						$REDIRS{redirect} = $PREF{$pref};
						$REDIRS{redirect} =~ s/%%username%%/$input_username/g;
						#last; # Actually, don't skip out after the first one; process them all so only the last one applies.
					}
				}
			}
			$REDIRS{referer} = determine_default_login_destination($ref);

			foreach my $redir_type (split(/\s*,\s*/, "force_pw_change, $PREF{login_destination_precedence_list}"))
			{
				if($REDIRS{$redir_type})
				{
					$go = $REDIRS{$redir_type};
					last;
				}
			}

			enc_redirect($go);
		}

		# Else they tried to log in but failed.
		else
		{
			# Be sure that we do the sleep before the email, so that any
			# potential email errors don't cause us to abort early thereby
			# skipping the sleep and possibly giving away the fact that the
			# login failed.
			#
			sleep $PREF{num_seconds_to_sleep_on_failed_login};

			my $account_locked = account_exceeds_failed_login_limit($input_username, 'increment');
			if($account_locked)
			{
				unless(enc_sql_select("SELECT `acct_locked` FROM `$PREF{user_table}` WHERE `username` = '$input_username'"))
				{
					my $success = enc_sql_update("UPDATE `$PREF{user_table}` SET `acct_locked` = TRUE WHERE `username` = '$input_username';");
					die_nice("Error: do_login(input_username='$input_username'): SQL returned '$success' instead of '1' while updating acct_locked.") unless $success == 1;
				}
			}

			update_failed_logins_table($input_username, $input_password);
			email_failed_logins_to_webmaster($input_username, $input_password);

			if($PREF{on_failed_login_redirect_to})
			{
				$go = $PREF{on_failed_login_redirect_to};

				if($account_locked)
				{
					$go .= $go =~ /\?/ ? '&account_locked=1' : '?account_locked=1';
				}
			}
			else
			{
				if($account_locked)	{ $go = "$PREF{login_url}?phase=eacctlck"; }
				else			{ $go = "$PREF{login_url}?phase=ebadauth"; }
			}

			enc_redirect($go);
		}
	}
	else
	{
		my $whence = ($qs =~ /(?:^|&)whence=(.+)/)[0]; $whence = '' if $whence =~ /(log(ged)?out|smsg=|kmsg=)/i;
		if($ENV{REQUEST_METHOD} =~ /post/i)
		{
			smsg_redirect('failedlogin') if param('password') !~ /\S/;
			my $hashed_password = md5_hex(param('password'));
			my $expiry = param('persist') eq 'on' ? "+$PREF{num_days_login_lasts}d" : '';

			smsg_redirect('failedlogin') unless ($PREF{all_admin_password_hashes}{$hashed_password}   ||   $PREF{all_member_password_hashes}{$hashed_password});

			set_cookie($PREF{non_userbase_login_cookie}, $hashed_password, $expiry);
			my $ref = param('ref'); $ref = '' if $ref =~ /(log(ged)?out|smsg=|kmsg=|\?newpw|\?login|action=login)/i;
			$whence =~ s!_THEQS_!?!g; $whence =~ s!_ANAMP_!&!g;
			enc_redirect($ref || $whence || $PREF{here});
		}
		else
		{
			if($PREF{all_admin_password_hashes})
			{
				my $action = $PREF{internal_appname} eq 'visitorlog' ? 'action=vllogin' : 'action=login';
				$action .= $PREF{default_url_vars};
				$action .= "&amp;whence=$whence" if $whence;
				start_html_output($PREF{subtitle___login});
				print	  qq`<form method="post" id="nonub_login" action="$ENV{SCRIPT_NAME}?$action">`
					. qq`\n<p>$TEXT{Enter_the_password}</p>\n<input type="password" name="password" maxlength="200" class="default text" /><input type="hidden" name="ref" value="$ENV{HTTP_REFERER}" />`
					. ($PREF{show_keep_me_logged_in_checkbox_on_login_page} !~ /yes/i ? '' : qq`\n<br /><br /><input type="checkbox" name="persist" id="persist" /><label for="persist"> $TEXT{Keep_me_logged_in_for} $PREF{num_days_login_lasts} $TEXT{days}</label>`)
					. qq`\n<br /><br /><input type="submit" value="$TEXT{Login}" class="default button submit" />\n</form>\n`;
				print $TEXT{Forgot_password_};
				finish_html_output();
			}
			else
			{
				$TEXT{password_not_set} =~ s!%%newpw_link%%!$PREF{here_login_qsready}newpw!g;
				exit_with_output($TEXT{password_not_set});
			}
		}
	}
}


sub check_if_logged_in()
{
	my %cookies = get_cookies();
	($PREF{admin_is_logged_in}, $PREF{member_is_logged_in}, $PREF{logged_in_username}, $PREF{logged_in_realname}, $PREF{logged_in_email}, $PREF{logged_in_userid}) = (0,0,'','','','');

	if($PREF{integrate_with_existing_login_system} =~ /yes/i   &&   $PREF{integrate_with_userbase} !~ /yes/i)
	{
		if($PREF{enable_username_from_apache_auth} =~ /yes/i)
		{
			if(my $username = $ENV{REMOTE_USER})
			{
				$PREF{logged_in_username}	= $username;
				$PREF{member_is_logged_in}	= 1;
				$PREF{admin_is_logged_in}	= $PREF{admin_usernames_list} =~ /(?:^|,)\s*$username\s*(?:,|$)/;
				$PREF{logged_in_userid}		= $PREF{admin_is_logged_in} ? -3 : -2;
			}
		}
		elsif($PREF{enable_username_from_cookie} =~ /yes/i)
		{
			my $username = '';
			if(exists($cookies{$PREF{username_cookie_name}})   &&   ($username = $cookies{$PREF{username_cookie_name}}->value))
			{
				$PREF{logged_in_username}	= $username;
				$PREF{member_is_logged_in}	= 1;
				$PREF{admin_is_logged_in}	= $PREF{admin_usernames_list} =~ /(?:^|,)\s*$username\s*(?:,|$)/;
				$PREF{logged_in_userid}		= $PREF{admin_is_logged_in} ? -3 : -2;
			}
		}
		elsif($PREF{enable_username_from_environment_variable} =~ /yes/i)
		{
			my $username = '';
			if(exists($ENV{$PREF{username_envvar_name}})   &&   ($username = $ENV{$PREF{username_envvar_name}}))
			{
				$PREF{logged_in_username}	= $username;
				$PREF{member_is_logged_in}	= 1;
				$PREF{admin_is_logged_in}	= $PREF{admin_usernames_list} =~ /(?:^|,)\s*$username\s*(?:,|$)/;
				$PREF{logged_in_userid}		= $PREF{admin_is_logged_in} ? -3 : -2;
			}
		}
		elsif($PREF{enable_username_from_php_session} =~ /yes/i)
		{
			my $username = '';
			if(exists $ENV{PHP_ENC_USERNAME}) # must use if(exists $foo) rather than just if($foo) so that we properly unset the variable when a user has logged out; otherwise we'd just pull it from our php-var-cache even though the user had already logged out.
			{
				$username = $ENV{PHP_ENC_USERNAME}; save_php_var_to_cache('username',$username);
			}
			else # we were POSTed to?
			{
				$username = get_php_var_from_cache('username');
			}

			if($username)
			{
				$PREF{logged_in_username}	= $username;
				$PREF{member_is_logged_in}	= 1;
				$PREF{admin_is_logged_in}	= $PREF{admin_usernames_list} =~ /(?:^|,)\s*$username\s*(?:,|$)/;
				$PREF{logged_in_userid}		= $PREF{admin_is_logged_in} ? -3 : -2;
			}
		}
		else
		{
			exit_with_error qq`To use \$PREF{integrate_with_existing_login_system}, you must also enable either \$PREF{enable_username_from_cookie}, \$PREF{enable_username_from_environment_variable}, \$PREF{enable_username_from_php_session}, or \$PREF{enable_username_from_apache_auth}.`;
		}
	}
	elsif($PREF{integrate_with_userbase_method_b} =~ /yes/i   &&   $PREF{path_to_userbase})
	{
		# Won't work on many IIS configurations where executing external commands
		# from within IIS is prevented by user account policy.  But the eval method
		# in the following block works on IIS.
		#
		my $userbase_output = `export QUERY_STRING="action=chklogin" && export SCRIPT_NAME="$PREF{userbase_local_scriptname}" && "$PREF{path_to_userbase}" 2>&1`;

		if($userbase_output !~ /\w+/)
		{
			# Use "package" to create a separate namespace for this block.  This is because we're going to use
			# "eval" as a way to execute another Perl script, but we only want that script's output; we don't
			# want its globals and subroutines being imported into our namespace.  In particular we don't want
			# functions such as start_html_output() "overwriting" our own copy of that function in the main
			# namespace.
			# 
			package CALLTOUBFORLOGINCHECK;

			# Don't die/die_nice anywhere in here; we want to let the next if() check whether $userbase_output
			# is valid and then print a more useful error if not.
			#
			my $file = $PREF{path_to_userbase};
			my $file_contents = ();
			open(IN,"<$file");
			flock IN, 1;
			seek IN, 0, 0;
			while(<IN>) { $file_contents .= $_; }
			close IN;

			$file_contents =~ /(.*)/s;
			$file_contents = $1; # cheap untaint since this is our own file.

			my ($real_qs, $real_sn) = ($ENV{QUERY_STRING}, $ENV{SCRIPT_NAME});
			($ENV{QUERY_STRING}, $ENV{SCRIPT_NAME}) = ("action=chklogin&print=false", $PREF{userbase_local_scriptname});
			$userbase_output = eval $file_contents;
			($ENV{QUERY_STRING}, $ENV{SCRIPT_NAME}) = ($real_qs, $real_sn);
		}

		if($userbase_output =~ /admin=(\d):::::member=(\d):::::username=(.*?):::::userid=(\d*?):::::group_memberships=(.*?):::::realname=(.*?):::::email=(.*?):::::(.*)/s)
		{
			($PREF{admin_is_logged_in},$PREF{member_is_logged_in},$PREF{logged_in_username},$PREF{logged_in_userid},$PREF{logged_in_group_memberships},$PREF{logged_in_realname},$PREF{logged_in_email})
			= ($1,$2,$3,$4,$5,$6,$7);

			$PREF{ub_var_username}	= $PREF{logged_in_username};
			$PREF{ub_var_userid}	= $PREF{logged_in_userid};
			$PREF{ub_var_realname}	= $PREF{logged_in_realname};
			$PREF{ub_var_email}	= $PREF{logged_in_email};

			if(my $other_ub_vars = $8)
			{
				while($other_ub_vars =~ /(.+?)=(.+?):::::/g)
				{
					$PREF{"ub_var_$1"} = $2;
					$PREF{"logged_in_$1"} = $2 unless $PREF{"logged_in_$1"};
				}
			}
		}
		else
		{
			exit_with_error("$PREF{internal_appname}: check_if_logged_in(): integrate_with_userbase_method_b failed: UserBase output was: "
				. ($userbase_output ? 'null' : "[[ $userbase_output ]] ")
				. qq`<br /><br />\n\nMake sure you've got UserBase itself running properly before trying this.`
			);
		}
	}
	elsif(userbase_available())
	{
		if(my $session_id = get_cookie($PREF{site_session_cookie}))
		{
			check_sessionid_for_sql_safeness($session_id);

			my ($username,$realname,$email,$id,$ip) = enc_sql_select("SELECT username,name,email,id,ip FROM `$PREF{user_table}` WHERE `mrsession` = '$session_id';");

			if($username   &&   $id   &&   !account_is_pending($id))
			{
				if(enc_sql_select("SELECT `acct_disabled` FROM `$PREF{user_table}` WHERE `id` = '$id';"))
				{
					enc_redirect("$PREF{login_url}?phase=eacctdis");
				}

				my $numusers = enc_sql_select("SELECT `numusers` FROM `$PREF{user_table}` WHERE `id` = '$id';");
				if(($numusers > 1) && $PREF{prevent_multiple_simultaneous_logons_per_username} =~ /yes/i)
				{
					# If there's already >1 user logged in under this username (for example, because we
					# didn't enable prevent_multiple_simultaneous_logons_per_username until after some
					# usage had already occurred), then we can't really do a one-by-one check to try and
					# decide which logins to kill, so kill them all.

					log_user_out_of_db($username, 'force');
					enc_redirect("$PREF{login_url}?phase=emultkicked");
				}

				# The IP check MUST come *after* the multiple_simultaneous_logons check, because if the
				# multiple_simultaneous_logons check fails, we need to take an action in response (namely
				# logging all the users out of the db) -- but if the IP check also fails (which is likely
				# to happen when the multiple_simultaneous_logons check fails) then we simply return, so
				# the multiple_simultaneous_logons check would never get a chance to do its db-logouts
				# if the IP check came first (and failed).
				#
				if(($PREF{enable_ip_address_restriction} =~ /yes/i && $ip) || ($PREF{force_ip_address_restriction} =~ /yes/i))
				{
					enc_redirect("$PREF{login_url}?phase=eipmismatch") unless $ip eq $PREF{ip};
				}

				$PREF{logged_in_username} = $username;
				$PREF{logged_in_realname} = $realname;
				$PREF{logged_in_email} = $email; $PREF{logged_in_email} = $PREF{logged_in_username} if ($PREF{logged_in_email} !~ /.+\@.+\..+/ && $PREF{logged_in_username} =~ /.+\@.+\..+/);
				$PREF{logged_in_userid} = $id;
				$PREF{member_is_logged_in} = 1;

				if(is_admin($PREF{logged_in_userid}))
				{
					$PREF{admin_is_logged_in} = 1;
				}

				$PREF{ub_var_username}	= $PREF{logged_in_username};
				$PREF{ub_var_userid}	= $PREF{logged_in_userid};
				$PREF{ub_var_realname}	= $PREF{logged_in_realname};
				$PREF{ub_var_email}	= $PREF{logged_in_email};

				foreach my $customfield (get_custom_userbase_field_names($PREF{user_table}))
				{
					my $value = enc_sql_select("SELECT `$customfield` FROM `$PREF{user_table}` WHERE `id` = '$PREF{logged_in_userid}'");
					$PREF{"ub_var_$customfield"} = $value;
					$PREF{"logged_in_$customfield"} = $value unless $PREF{"logged_in_$customfield"};
				}

				# This depends on $PREF{logged_in_userid}, so must come after that is set; but since
				# this is an acct-disabled check, it should still come *before* we officially mark the
				# user as logged in (i.e. before we update the database).
				#
				if(user_is_part_of_a_subgroup($id) && $PREF{subgroup_owned_users_get_disabled_when_their_manager_does} =~ /yes/i)
				{
					die_unless_numeric($PREF{subgroup_manager_userid}, 'subgroup manager user ID');
					if(enc_sql_select("SELECT `acct_disabled` FROM `$PREF{user_table}` WHERE `id` = '$PREF{subgroup_manager_userid}';"))
					{
						enc_redirect("$PREF{login_url}?phase=eacctdis");
					}
				}

				check_and_update_login_session($PREF{logged_in_userid});

				if(force_pw_change($PREF{logged_in_userid}))
				{
					if($PREF{internal_appname} eq 'userbase')
					{
						if($qs !~ /^(logout|logoutall|action=commitedituser)$/)
						{
							print_user_form('edit', $PREF{logged_in_userid});
							exit;
						}
					}
					else
					{
						enc_redirect("$PREF{login_url_qsready}action=edituser&id=$PREF{logged_in_userid}");
					}
				}
			}
		}
	}
	elsif($PREF{all_admin_password_hashes} || $PREF{all_member_password_hashes})
	{
		my $hashed_password_in_cookie = get_cookie($PREF{non_userbase_login_cookie});

		if($hashed_password_in_cookie   &&   $PREF{all_admin_password_hashes}{$hashed_password_in_cookie})
		{
			($PREF{admin_is_logged_in}, $PREF{member_is_logged_in}, $PREF{logged_in_username}, $PREF{logged_in_userid}) = (1, 1, '', -3);
		}
		elsif($hashed_password_in_cookie   &&   $PREF{all_member_password_hashes}{$hashed_password_in_cookie})
		{
			($PREF{admin_is_logged_in}, $PREF{member_is_logged_in}, $PREF{logged_in_username}, $PREF{logged_in_userid}) = (0, 1, '', -2);
		}
		# TODO: explicitly set 0/0/''/-1 for public?
	}
}


sub check_and_update_login_session($)
{
	my $userid = shift;
	my $my_session_id = get_cookie($PREF{site_session_cookie});
	my $session_id_in_db = enc_sql_select("SELECT `mrsession` FROM `$PREF{user_table}` WHERE `id` = $userid;");
	my $login_time = enc_sql_select("SELECT `loggedin` FROM `$PREF{user_table}` WHERE `id` = $userid;");

	#if(   ($my_session_id == $session_id_in_db)   &&   ($login_time =~ /[1-9]/   &&   !login_session_expired($login_time))   )
	 if(   ($my_session_id == $session_id_in_db)   &&   (!login_session_expired($login_time))   )
	{
		 update_loggedin_time($userid, $my_session_id, offsettime());
	}
	else
	{
		do_logout() if $PREF{idle_timeout} > 0;
	}
}


sub update_loggedin_time
{
	my ($userid, $my_session_id, $newtime) = @_;

	die_unless_numeric($userid,'userid');
	die_unless_numeric($newtime,'newtime');
	check_sessionid_for_sql_safeness($my_session_id);

	my $value_is_unchanged = $newtime == enc_sql_select("SELECT `loggedin` FROM `$PREF{user_table}` WHERE `id` = $userid AND `mrsession` = '$my_session_id'");
	unless($value_is_unchanged) # prevent the 0E0 error, which isn't actually an error in the case that the value was unchanged.
	{
		my $success = enc_sql_update("UPDATE `$PREF{user_table}` SET `loggedin` = $newtime WHERE `id` = $userid AND `mrsession` = '$my_session_id'");
		die_nice("Error: update_loggedin_time('$userid', '$my_session_id', '$newtime'): SQL returned '$success' instead of '1' while updating loggedin.") unless $success == 1;
	}

	if(db_column_exists('lastactive', $PREF{user_table})) # for backwards compatibility with older versions of apps.
	{
		my $value_is_unchanged = $newtime == enc_sql_select("SELECT `lastactive` FROM `$PREF{user_table}` WHERE `id` = $userid AND `mrsession` = '$my_session_id'");
		unless($value_is_unchanged) # prevent the 0E0 error, which isn't actually an error in the case that the value was unchanged.
		{
			my $success = enc_sql_update("UPDATE `$PREF{user_table}` SET `lastactive` = $newtime WHERE `id` = $userid AND `mrsession` = '$my_session_id'");
			die_nice("Error: update_loggedin_time('$userid', '$my_session_id', '$newtime'): SQL returned '$success' instead of '1' while updating lastactive.") unless $success == 1;
		}
	}
}


sub login_session_expired($)
{
	my $loggedin_time = shift;
	return (

		(   ($PREF{idle_timeout} > 0)   &&   (offsettime() - $loggedin_time > $PREF{idle_timeout})   )

		||

		(
			($PREF{num_days_rememberme_cookie_lasts} > 0)
			&&
			(   offsettime()   >   ($loggedin_time + ($PREF{num_days_rememberme_cookie_lasts} * 86400))   )
		)
	);
}


sub log_user_out_of_db
{
	my ($username, $my_session_id) = @_;

	check_username_for_sql_safeness($username);
	check_sessionid_for_sql_safeness($my_session_id) unless $my_session_id eq 'force';

	# It's possible (and probably not particularly uncommon) that a user logs in at one location, then leaves
	# that location and his session goes idle, and then he logs in at another location with the same account.  In
	# that case, a call to log_user_out_of_db() from the first location should not actually do the db logout, 
	# because the session does not belong to him anymore.  But note that this is not an error condition, so we
	# should just silently return.
	#
	my $session_id_in_db = enc_sql_select("SELECT `mrsession` FROM `$PREF{user_table}` WHERE LOWER(`username`) = LOWER('$username');");

	if(($my_session_id == $session_id_in_db)   ||   ($my_session_id eq 'force'))
	{
		my $success = enc_sql_update("UPDATE `$PREF{user_table}` SET `loggedin` = 0 WHERE LOWER(`username`) = LOWER('$username');");
		die_nice("Error: log_user_out_of_db('$username', '$my_session_id'): SQL returned '$success' instead of '1' while setting loggedin to zero.") unless $success == 1;

		$success = enc_sql_update("UPDATE `$PREF{user_table}` SET `mrsession` = '' WHERE LOWER(`username`) = LOWER('$username');");
		die_nice("Error: log_user_out_of_db('$username', '$my_session_id'): SQL returned '$success' instead of '1' while setting mrsession to null.") unless $success == 1;

		my $numusers = enc_sql_select("SELECT `numusers` FROM `$PREF{user_table}` WHERE LOWER(`username`) = LOWER('$username');");
		if($numusers) # this check only required because of crappy old MySQL versions that fail to ever set numusers properly in the DB (??).
		{
			$success = enc_sql_update("UPDATE `$PREF{user_table}` SET `numusers` = 0 WHERE LOWER(`username`) = LOWER('$username');");
			die_nice("Error: log_user_out_of_db('$username', '$my_session_id'): SQL returned '$success' instead of '1' while setting numusers to zero.") unless $success == 1;
		}
	}
}


sub do_logout
{
	if($PREF{internal_appname} eq 'userbase')
	{
		my $force_logout_all = shift; $force_logout_all = $force_logout_all eq 'all' ? 1 : 0;

		if($PREF{we_are_virtual})
		{
			print_http_headers();
			$PREF{forced_logout_link} =~ s/%%logout_url%%/$PREF{logout_url}/g;
			print $PREF{forced_logout_link};
			exit;
		}
		else
		{
			my $ref = $ENV{HTTP_REFERER};
			if($ref)
			{
				# Remove the "logout" from the referrer, otherwise we'll get stuck
				# in an infinite logout loop with this Location: call.
				$ref =~ s/\?.*log(ged)?out.*//;

				$ref = '' if $ref =~ /(smsg=|kmsg=)/i; # don't redirect to any static/keyed messages that probably no longer apply now that the login state has changed.
			}

			# Delete the login cookie regardless of $PREF{member_is_logged_in}, because
			# it may be that the user has the cookie but it's invalid (expired, wrong IP,
			# etc) in which case we didn't set $PREF{member_is_logged_in}.  In that case,
			# we still want to allow the user to force a logout (i.e. delete his cookie).
			#
			delete_login_cookie();

			my $whence = '';
			if($PREF{member_is_logged_in})
			{
				if($PREF{prevent_multiple_simultaneous_logons_per_username} =~ /yes/i   ||   $force_logout_all)
				{
					log_user_out_of_db($PREF{logged_in_username}, get_cookie($PREF{site_session_cookie}));
				}
				else
				{
					die_unless_numeric($PREF{logged_in_userid}, 'logged_in_userid');
					my $numusers = enc_sql_select("SELECT `numusers` FROM `$PREF{user_table}` WHERE `id` = '$PREF{logged_in_userid}';");
					if($numusers > 1)
					{
						my $success = enc_sql_update("UPDATE `$PREF{user_table}` SET `numusers`=GREATEST((`numusers`-1),0) WHERE `id` = '$PREF{logged_in_userid}';");
						die_nice("Error: do_logout(): SQL returned '$success' instead of '1' while decrementing numusers column.") unless $success == 1;
					}
					else
					{
						log_user_out_of_db($PREF{logged_in_username}, get_cookie($PREF{site_session_cookie}));
					}
				}

				if($PREF{admin_is_logged_in}   &&   $PREF{on_admin_logout_redirect_to})
				{
					$PREF{on_admin_logout_redirect_to} =~ s/%%username%%/$PREF{logged_in_username}/g;
					enc_redirect($PREF{on_admin_logout_redirect_to});
				}
				elsif($PREF{member_is_logged_in}   &&   !$PREF{admin_is_logged_in}   &&   $PREF{on_member_logout_redirect_to}) # need the !admin because admins are members too.
				{
					$PREF{on_member_logout_redirect_to} =~ s/%%username%%/$PREF{logged_in_username}/g;
					enc_redirect($PREF{on_member_logout_redirect_to});
				}
				else
				{
					# After logging out, return to the page we were on.
					$whence = $ref;
				}
			}
			else
			{
				if($PREF{on_fake_logout_redirect_to})
				{
					enc_redirect($PREF{on_fake_logout_redirect_to});
				}
				else
				{
					$whence = $ref;
				}
			}

			$whence =~ s!^https?://$ENV{HTTP_HOST}!!; # some servers don't like extra "http://"s in URLs.
			enc_urlencode($whence);
			$whence = '' if $PREF{server_bug_prohibits_use_of_whence} =~ /yes/i;
			enc_redirect("$PREF{login_url_qsready}action=loggedout&whence=$whence");
		}
	}
	else
	{
		my $go = '';
		if($PREF{integrate_with_userbase} =~ /yes/i   ||   $PREF{integrate_with_userbase_method_b} =~ /yes/i   ||   $PREF{integrate_with_existing_login_system} =~ /yes/i)
		{
			$go = $PREF{logout_url};
		}
		else
		{
			set_cookie($PREF{non_userbase_login_cookie}, 'blank', '-1d');
			my $whence = $ENV{HTTP_REFERER};
			$whence =~ s!^https?://$ENV{HTTP_HOST}!!; # some servers don't like extra "http://"s in URLs.
			$whence =~ s/\?logout$//; # Remove "logout" from the ref so we don't get stuck in an infinite loop.
			$go = "$PREF{here_login_qsready}action=loggedout&whence=$whence";
		}

		if($PREF{we_are_virtual})
		{
			print_http_headers();
			if($PREF{use_javascript_redirect_when_necessary} !~ /no/i)
			{
				print qq`\n<script type="text/javascript">location.href="$go";</script>\n`;
			}
			else
			{
				$PREF{forced_logout_link} =~ s/%%logout_url%%/$go/g;
				print $PREF{forced_logout_link};
			}
			exit;
		}
		else
		{
			enc_redirect($go);
		}
	}
}


sub delete_login_cookie
{
	set_cookie($PREF{site_session_cookie}, 0, '-1M');
}


sub show_loggedout_page
{
	my $ref = shift;
	enc_urldecode($ref);
	$ref = '' if $ref =~ /(log(ged)?out|smsg=|kmsg=|phase=)/i;
	my $message = $PREF{loggedout_page_template__no_referer};
	if($ref)
	{
		$message = $PREF{loggedout_page_template__with_referer};
		$message =~ s/%%ref%%/$ref/g;
	}
	exit_with_success($message);
}


sub get_logout_url
{
	return $PREF{integrate_with_userbase} =~ /yes/i || $PREF{integrate_with_userbase_method_b} =~ /yes/i || $PREF{integrate_with_existing_login_system} =~ /yes/i ? $PREF{logout_url} : ($ENV{SCRIPT_NAME} . ($ENV{SCRIPT_NAME} =~ /\?/ ? '&' : '?') . "logout");
}


sub get_login_url
{
	return $PREF{integrate_with_userbase} =~ /yes/i || $PREF{integrate_with_userbase_method_b} =~ /yes/i || $PREF{integrate_with_existing_login_system} =~ /yes/i ? $PREF{login_url} : "$PREF{here_login_qsready}action=login";
}


# This function must do a case-sensitive lookup (i.e., do NOT use LOWER()) because
# FC's userdirs are case-sensitive.  So whatever case is used when a username is
# created is the case that must always be used when logging in with it.
# UPDATE: MySQL's equal operator (=) is case-insensitive, absurdly.  To force it
# to act case-sensitively, you must use the BINARY function, as in:
#	... WHERE BINARY `username` = '$username'
#
sub account_exists($$$)
{
	#printd "account_exists('$_[0]', '$_[1]', '$_[2]')\n";

	my $user = shift;
	my $pass = shift;
	my $third_arg = shift;

	check_username_for_sql_safeness($user);
	check_hashedpw_for_sql_safeness($pass);

	my $BINARY = $PREF{make_usernames_case_insensitive} =~ /yes/i ? '' : 'BINARY';

	my $count = ();
	if($third_arg eq 'new_login')
	{
		$count = enc_sql_select("SELECT COUNT(*) FROM `$PREF{user_table}` WHERE $BINARY `username` = '$user' AND `password` = '$pass'");
	}
	else
	{
		die_unless_numeric($third_arg,'userid');
		$count = enc_sql_select("SELECT COUNT(*) FROM `$PREF{user_table}` WHERE $BINARY `username` = '$user' AND `password` = '$pass' AND `id` = $third_arg");
	}

	if($count == 1)		{ return 1; }
	elsif($count > 1)	{ die_nice("$0: account_exists('$user', '$pass', '$third_arg'): error: duplicate records ($count total) for this user!\n"); }
	else			{ return 0; }
}


sub account_is_pending
{
	return 0 if !userbase_available();
	my $userid = shift;
	die_unless_numeric($userid, "user ID in account_is_pending()");
	return (account_is_pending_email_verification($userid) || account_is_pending_admin_approval($userid) || account_is_pending_payment($userid));
}


sub account_is_pending_email_verification
{
	my $userid = shift;
	return ($PREF{require_email_verification_for_new_signups} =~ /yes/i) && account_is_pending_email_verification_in_db($userid);
}


sub account_is_pending_email_verification_in_db
{
	my $userid = shift;
	die_unless_numeric($userid, "user ID in account_is_pending_email_verification_in_db()");
	return enc_sql_select("SELECT `pending_email_verification` FROM `$PREF{user_table}` WHERE `id` = $userid");
}


sub account_has_completed_email_verification
{
	my $userid = shift;
	die_unless_numeric($userid, "user ID in account_has_completed_email_verification()");
	return enc_sql_select("SELECT `completed_email_verification` FROM `$PREF{user_table}` WHERE `id` = $userid");
}


sub account_is_pending_admin_approval
{
	my $userid = shift;
	return ($PREF{require_admin_approval_for_new_signups} =~ /yes/i) && account_is_pending_admin_approval_in_db($userid);
}


sub account_is_pending_admin_approval_in_db
{
	my $userid = shift;
	die_unless_numeric($userid, "user ID in account_is_pending_admin_approval_in_db()");
	return enc_sql_select("SELECT `pending_admin_approval` FROM `$PREF{user_table}` WHERE `id` = $userid");
}


sub account_is_pending_payment
{
	my $userid = shift;
	die_unless_numeric($userid, "user ID in account_is_pending_payment()");
	return enc_sql_select("SELECT `pending_payment` FROM `$PREF{user_table}` WHERE `id` = $userid");
}


sub account_has_completed_payment
{
	my $userid = shift;
	die_unless_numeric($userid, "user ID in account_has_completed_payment()");
	return enc_sql_select("SELECT COUNT(*) FROM `$PREF{payments_table}` WHERE `userid` = $userid");
}


sub get_custom_userbase_field_names
{
	my $which_user_table = shift;
	my $include_disabled_fields = shift;

	my (@custom_fields, %custom_fields) = ();
	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{custom_field_list_table}`"))
	{
		my ($fieldname,$fieldlabel,$enabled) = ();
		my $sth = $PREF{dbh}->prepare("SELECT fieldname,fieldlabel,enabled FROM `$PREF{custom_field_list_table}` ORDER BY `fieldposition`");
		$sth->execute() or die_nice("$PREF{internal_appname}: Error: get_custom_userbase_field_names(): $DBI::errstr\n");
		$sth->bind_columns(\$fieldname,\$fieldlabel,\$enabled);
		while($sth->fetchrow_arrayref)
		{
			next unless db_column_exists($fieldname, $which_user_table);
			next if (!$enabled   &&   !$include_disabled_fields);
			$custom_fields{$fieldname} = 1;
			push @custom_fields, $fieldname;
		}
	}

	return wantarray ? @custom_fields : \%custom_fields;
}


sub is_admin($)
{
	#printd "is_admin('$_[0]')\n";

	my $userid = shift;
	return 0 unless $userid;

	return 1 if (!userbase_available()   &&   $userid == -3);

	# don't bother checking the validity of $userid here,
	# because user_is_member_of_group() will do it.
	return user_is_member_of_group($userid,$PREF{admin_group_name});
}


sub force_pw_change($)
{
	my $userid = shift;
	my $force_pw_change = 0;

	if(		$PREF{enable_forced_password_change} =~ /yes/i
			&&
			enc_sql_select("SELECT `forcepwchng` FROM `$PREF{user_table}` WHERE `id` = '$userid';")
			&&
			(
				!is_admin($userid)
				||
				(is_admin($userid) && $PREF{admins_can_be_forced_to_change_their_own_pws} =~ /yes/i)
			)
	)
	{
		$force_pw_change = 1;
	}

	if(password_has_expired())
	{
		$force_pw_change = 1;
	}

	return $force_pw_change;
}


sub password_has_expired
{
	my $expired = 0;
	if($PREF{force_pw_chng_after_this_many_hours} =~ /^\d+$/ && $PREF{force_pw_chng_after_this_many_hours} > 0)
	{
		unless($PREF{admin_is_logged_in} && $PREF{admins_can_be_forced_to_change_their_own_pws} =~ /no/i)
		{
			my $time_now = offsettime();
			die_unless_numeric($PREF{logged_in_userid}, '$PREF{logged_in_userid}');
			my $time_of_last_pw_change = enc_sql_select("SELECT MAX(`timestamp`) FROM `$PREF{password_activity_table}` WHERE `user_id` = $PREF{logged_in_userid}");
			$expired = 1 if ($time_now - $time_of_last_pw_change) > ($PREF{force_pw_chng_after_this_many_hours} * 3600);
		}
	}
	return $expired;
}


sub get_group_id($)
{
	printd "get_group_id($_[0])\n";
	my $group = shift;

	if(userbase_available())
	{
		check_groupname_for_uniqueness($group); # checks for sql safeness too.
		return enc_sql_select("SELECT `id` FROM `$PREF{group_table}` WHERE `group` = '$group'");
	}
	else
	{
		   if($group =~ /^$PREF{public_group_name}$/i)	{ return -1; }
		elsif($group =~ /^$PREF{member_group_name}$/i)	{ return -2; }
		elsif($group =~ /^$PREF{admin_group_name}$/i)	{ return -3; }
		else { die_nice("invalid group name '$group'.\n"); }
	}
}


sub check_uid_for_uniqueness($)
{
	#die_unless_numeric($_[0], 'user ID'); # UIDs can be negative, so this test doesn't work here; and check_id_for_sql_safeness takes care of it anyway.
	check_id_for_sql_safeness($_[0]);
	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{user_table}` WHERE `id` = $_[0]")   >   1)
	{
		die_nice("more than one user record with id=$_[0]!\n");
	}
}


sub check_gid_for_uniqueness($)
{
	return unless userbase_available();
	printd "check_gid_for_uniqueness: '$_[0]'\n";

	check_id_for_sql_safeness($_[0]);
	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{group_table}` WHERE `id` = $_[0]")   >   1)
	{
		die_nice("more than one group record with id=$_[0]!\n");
	}
}


sub check_username_for_uniqueness($)
{
	#printd "check_username_for_uniqueness: '$_[0]'\n";

	check_username_for_sql_safeness($_[0]);
	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{user_table}` WHERE LOWER(`username`) = LOWER('$_[0]')")   >   1)
	{
		die_nice("more than one user record with username='$_[0]'!\n");
	}
}


sub check_groupname_for_uniqueness
{
	return unless userbase_available();
	printd "check_groupname_for_uniqueness($_[0])\n";

	check_groupname_for_sql_safeness($_[0]);
	if(enc_sql_select("SELECT COUNT(*) FROM `$PREF{group_table}` WHERE LOWER(`group`) = LOWER('$_[0]')")   >   1)
	{
		die_nice("more than one user record with groupname='$_[0]'!\n");
	}
}


sub user_is_member_of_group
{
	my $userid = shift;
	my $group = shift;
	my $not_checking_loggedin_user = shift;

	if($PREF{integrate_with_userbase_method_b} =~ /yes/i   &&   $PREF{logged_in_group_memberships}   &&   !$not_checking_loggedin_user)
	{
		return $PREF{logged_in_group_memberships} =~ /(^|,)$group(,|$)/;
	}
	if(userbase_available()   &&   ($PREF{member_is_logged_in} || $not_checking_loggedin_user))
	{
		check_groupname_for_sql_safeness($group);
		die_unless_numeric($userid,'userid');

		return 1 if $group =~ /^$PREF{public_group_name}$/i;
		return 1 if $group =~ /^$PREF{member_group_name}$/i && enc_sql_select("SELECT COUNT(*) FROM `$PREF{user_table}` WHERE `id` = $userid;");

		# special internal groups:
		return 1 if $group eq 'encwhitelisted' && $PREF{user_is_encwhitelisted};
		return 1 if $group eq 'encblacklisted' && $PREF{user_is_encblacklisted};

		return enc_sql_select("SELECT COUNT(*) FROM `$PREF{group_table}` WHERE LOWER(`group`) = LOWER('$group') AND `members` REGEXP '(^|,)$userid(,|\$)'");
	}
	else
	{
		# special internal groups:
		return 1 if $group eq 'encwhitelisted' && $PREF{user_is_encwhitelisted};
		return 1 if $group eq 'encblacklisted' && $PREF{user_is_encblacklisted};

		return 1 if $group =~ /^$PREF{public_group_name}$/i;
		return 1 if $group =~ /^$PREF{member_group_name}$/i && $userid =~ /^-(2|3)$/;
		return 1 if $group =~ /^$PREF{admin_group_name}$/i && $userid == -3;
	}
}


sub user_belongs_to_one_of_these_group_ids($$)
{
	my $uid = shift;
	my $idlist = shift; # list of numeric group IDs separated either by commas or "|||".
	$idlist =~ s!\|\|\|!,!g;
	my $belongs = 0;
	foreach my $gid (split(/\s*,\s*/, $idlist))
	{
		#$belongs = 1 if user_is_member_of_group($uid, get_group_name($gid));
		if(user_is_member_of_group($uid, get_group_name($gid)))
		{
			#encdebug qq`user $uid IS member of group ` . get_group_name($gid) . qq` (list=$idlist)`;
			$belongs = 1;
		}
	}
	return $belongs;
}


sub logged_in_user_belongs_to_one_of_these_group_ids($)
{
	return user_belongs_to_one_of_these_group_ids($PREF{logged_in_userid}, $_[0]);
}


sub userbase_available
{
	return ($PREF{internal_appname} eq 'userbase'   ||   $PREF{integrate_with_userbase} =~ /yes/i   ||   $PREF{integrate_with_userbase_method_b} =~ /yes/i);
}


sub get_user_id($)
{
	#printd "get_user_id('$_[0]')\n";

	my $username = shift;

	if(userbase_available()   &&   $username)
	{
		die_nice("Error: invalid username '$username'.\n") unless username_is_valid($username);
		check_username_for_uniqueness($username); # checks for sql safeness too.
		return enc_sql_select("SELECT `id` FROM `$PREF{user_table}` WHERE LOWER(`username`) = LOWER('$username')");
	}
	else
	{
		   if($PREF{admin_is_logged_in})	{ return -3; }
		elsif($PREF{member_is_logged_in})	{ return -2; }
		else					{ return -1; } # public.
	}
}


sub get_member_ids_for_group
{
	printd "get_member_ids_for_group($_[0])\n";

	my $group = shift;
	check_groupname_for_sql_safeness($group);

	 # every account is automatically a member of these groups.
	if($group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i)
	{
		my $statement = "SELECT `id` FROM `$PREF{user_table}`";
		return $PREF{dbh}->selectall_hashref($statement, 'id');
	}
	else
	{
		my $member_ids = enc_sql_select("SELECT `members` FROM `$PREF{group_table}` WHERE LOWER(`group`) = LOWER('$group')");
		my %member_ids = map { $_ => 1 } split(/,/, $member_ids);
		return \%member_ids;
	}
}


# 20110404: APICHANGE: previously this sub accepted just a single argument,
# which was the group name.  Now it accepts an anonymous hash.
#
sub get_users_belonging_to_group
{
	# Example usage:
	#my $users = get_users_belonging_to_group({ group=>'member' });
	#foreach my $uid (keys %$users)
	#{
	#	print qq`Name: $$users{$uid}{name}, Email: $$users{$uid}{email} <br /><br />`;
	#}

	my $optsref = shift; my %opts = %$optsref if $optsref;

	my $group = $opts{group};
	check_groupname_for_sql_safeness($group);
	my $userids = '';

	if($group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i)
	{
		my $userids_hashref = enc_sql_select_multi("SELECT `id` FROM `$PREF{user_table}`");
		foreach my $j (sort { $a <=> $b } keys %$userids_hashref) { $userids .= $$userids_hashref{$j}{id} . ","; }
		decommaify($userids);
	}
	else
	{
		$userids = enc_sql_select("SELECT `members` FROM `$PREF{group_table}` WHERE LOWER(`group`) = LOWER('$group')");
	}

	my %users = ();
	foreach my $uid (split(/,/, $userids))
	{
		die_unless_numeric($uid, 'user ID');
		next if $opts{exclude_pending} && account_is_pending($uid);
		next if $opts{exclude_admins} && is_admin($uid);
		my $userdata = enc_sql_select_multi("SELECT * FROM `$PREF{user_table}` WHERE `id` = $uid");
		foreach my $field (keys %{$$userdata{1}})
		{
			$users{$uid}{$field} = $$userdata{1}{$field};
		}
	}

	return \%users;
}


sub get_user_name($)
{
	return unless userbase_available();
	check_uid_for_uniqueness($_[0]); # checks for sql safeness too.
	return enc_sql_select("SELECT `username` FROM `$PREF{user_table}` WHERE `id` = $_[0]");
}


sub get_group_name($)
{
	my $gid = shift;
	if(userbase_available())
	{
		check_gid_for_uniqueness($gid); # checks for sql safeness too.
		return enc_sql_select("SELECT `group` FROM `$PREF{group_table}` WHERE `id` = $gid");
	}
	else
	{
		   if($gid == -1)	{ return $PREF{public_group_name}; }
		elsif($gid == -2)	{ return $PREF{member_group_name}; }
		elsif($gid == -3)	{ return $PREF{admin_group_name}; }
		else { die_nice("$PREF{internal_appname}: get_group_name(): invalid group ID '$gid'.\n"); }
	}
}


sub get_email_address($)
{
	return unless userbase_available();
	check_uid_for_uniqueness($_[0]); # checks for sql safeness too.
	my ($username,$email) = enc_sql_select("SELECT `username`,`email` FROM `$PREF{user_table}` WHERE `id` = $_[0]");
	$email = $username if is_valid_email_address($username) && !is_valid_email_address($email);
	return $email;
}


sub hashedpw_is_valid				{ return  $_[0] =~ /^[0-9A-Za-z]+$/					&&	length($_[0]) <= $PREF{max_hashedpw_length};	}
sub sessionid_is_valid				{ return  $_[0] =~ /^[0-9A-Za-z]+$/					&&	length($_[0]) <= $PREF{max_hashedpw_length};	}


sub username_is_valid
{
	my $space = $PREF{allow_spaces_in_usernames} =~ /yes/i ? ' ' : '';
	my $atsign = $PREF{allow_atsigns_in_usernames} =~ /yes/i ? '@' : '';
	my $dot = $PREF{allow_dots_in_usernames} =~ /yes/i ? '.' : '';
	my $dash = $PREF{allow_dashes_in_usernames} =~ /yes/i ? '-' : '';

	return ($_[0] =~ /^[0-9A-Za-z_$space$atsign$dot$dash]+$/   &&   $_[0] =~ /\w/	&&	length($_[0]) <= $PREF{max_username_length});
}

sub groupname_is_valid
{
	my $space	= ($PREF{allow_spaces_in_usernames} =~ /yes/i	|| $PREF{allow_spaces_in_groupnames} =~ /yes/i)		? ' ' : '';
	my $atsign	= ($PREF{allow_atsigns_in_usernames} =~ /yes/i	|| $PREF{allow_atsigns_in_groupnames} =~ /yes/i)	? '@' : '';
	my $dot		= ($PREF{allow_dots_in_usernames} =~ /yes/i	|| $PREF{allow_dots_in_groupnames} =~ /yes/i)		? '.' : '';
	my $dash	= ($PREF{allow_dashes_in_usernames} =~ /yes/i	|| $PREF{allow_dashes_in_groupnames} =~ /yes/i)		? '-' : '';

	return ($_[0] =~ /^[0-9A-Za-z_$space$atsign$dot$dash]+$/   &&   $_[0] =~ /\w/	&&	length($_[0]) <= $PREF{max_groupname_length});
}

sub check_hashedpw_for_sql_safeness		{ die_nice(qq`Invalid hashed password:	'$_[0]' [called from: ` . (caller 1)[3]  . qq`]`) unless hashedpw_is_valid($_[0]);	}
sub check_username_for_sql_safeness		{ die_nice(qq`Invalid username:		'$_[0]' [called from: ` . (caller 1)[3]  . qq`]`) unless username_is_valid($_[0]);	}
sub check_groupname_for_sql_safeness		{ die_nice(qq`Invalid groupname:	'$_[0]' [called from: ` . (caller 1)[3]  . qq`]`) unless groupname_is_valid($_[0]);	}
sub check_sessionid_for_sql_safeness		{ die_nice(qq`Invalid session ID:	'$_[0]' [called from: ` . (caller 1)[3]  . qq`]`) unless sessionid_is_valid($_[0]);	}
sub check_id_for_sql_safeness			{ die_nice(qq`Invalid ID:		'$_[0]' [called from: ` . (caller 1)[3]  . qq`]`) unless $_[0] =~ /^(\d+|-[123])$/;	}


sub get_groups_hash
{
	printd "get_groups_hash('$_[0]')\n";

	# If you pass in a uid, then the resulting hash will
	# also indicate which groups that user is a member of.
	#

	my $user_id = shift;

	my ($id, $group, $members, %groups) = ();
	if(userbase_available())
	{
		my $sth = $PREF{dbh}->prepare("SELECT `id`, `group`, `members` FROM `$PREF{group_table}`");
		$sth->execute();
		$sth->bind_columns(\$id, \$group, \$members);
		while($sth->fetchrow_arrayref)
		{
			$groups{$group}{name} = $group;
			$groups{$group}{id} = $id;
			$groups{$group}{members} = $members;

			my $is_member = ();
			   if($group =~ /^($PREF{public_group_name}|$PREF{member_group_name})$/i)	{ $is_member = 1; }
			elsif($user_id =~ /^\d+$/)							{ $is_member = $members =~ /(^|,)$user_id(,|$)/; }

			$groups{$group}{is_member} = $is_member;
		}
	}
	else
	{
		$groups{$PREF{public_group_name}}{name}		= $PREF{public_group_name};
		$groups{$PREF{public_group_name}}{id}		= -1;
		$groups{$PREF{public_group_name}}{is_member}	= 1; # everyone's a member of the public.

		$groups{$PREF{member_group_name}}{name}		= $PREF{member_group_name};
		$groups{$PREF{member_group_name}}{id}		= -2;
		$groups{$PREF{member_group_name}}{is_member}	= 1 if $user_id =~ /^-(2|3)$/;

		$groups{$PREF{admin_group_name}}{name}		= $PREF{admin_group_name};
		$groups{$PREF{admin_group_name}}{id}		= -3;
		$groups{$PREF{admin_group_name}}{is_member}	= 1 if $user_id =~ /^-3$/;
	}

	return \%groups;
}


sub get_email_addresses_for_all_members_of_this_users_groups
{
	my $uid = shift; die_unless_numeric($uid, "user ID");
	my $include_users_own_email_address = shift; $include_users_own_email_address = 0 unless $include_users_own_email_address eq 'include_users_own_email_address';
	my $include_builtin_public_group = shift;    $include_builtin_public_group    = 0 unless $include_builtin_public_group    eq 'include_builtin_public_group';
	my $include_builtin_member_group = shift;    $include_builtin_member_group    = 0 unless $include_builtin_member_group    eq 'include_builtin_member_group';
	my $include_builtin_admin_group = shift;     $include_builtin_admin_group     = 0 unless $include_builtin_admin_group     eq 'include_builtin_admin_group';

	my %email_addresses = ();
	my $allgroups = get_groups_hash($uid);
	foreach my $group (sort keys %$allgroups)
	{
		next if $group =~ /^$PREF{public_group_name}$/i && !$include_builtin_public_group;
		next if $group =~ /^$PREF{member_group_name}$/i && !$include_builtin_member_group;
		next if $group =~ /^$PREF{admin_group_name}$/i  && !$include_builtin_admin_group;

		if(my $this_user_belongs_to_this_group = $$allgroups{$group}{is_member})
		{
			foreach my $member_id (split(/\s*,\s*/, $$allgroups{$group}{members}))
			{
				my $email = get_email_address($member_id);
				$email_addresses{ $email } = 1 unless !$include_users_own_email_address && $email eq $PREF{logged_in_email};
			}
		}
	}
	return keys %email_addresses;   # returns an array when this sub is called in list context.
}


# This function must do a case-insensitive lookup (i.e. use LOWER() on both sides)
# so that we never create a username multiple times with different cases.
#
sub username_is_taken
{
	return 0 unless userbase_available();
	my $user = shift;
	check_username_for_sql_safeness($user);
	return enc_sql_select("SELECT COUNT(*) FROM `$PREF{user_table}` WHERE LOWER(`username`) = LOWER('$user')");
}


sub email_address_is_taken
{
	my $address = shift;
	check_emailaddr_for_sql_safeness($address);
	return enc_sql_select("SELECT COUNT(*) FROM `$PREF{user_table}` WHERE LOWER(`email`) = LOWER('$address')");
}


sub salt_and_crypt_password($$)
{
	my $plaintext_password = shift;
	my $salt = shift;
	$plaintext_password = lc($plaintext_password) if $PREF{make_passwords_case_insensitive} =~ /yes/i;
	die "$0: salt_and_crypt_password(): no salt?\n" unless $salt;
	my ($salt1,$salt2) = ($salt =~ /^(.{15})(.{25})$/);
	my $crypted_password = enc_hash($salt1 . $plaintext_password . $salt2);
	return $crypted_password;
}


sub make_password_hash
{
	if($ENV{REQUEST_METHOD} =~ /post/i)
	{
		my $hashed_password = md5_hex(param('password'));
		start_html_output('Here is your hashed password...');
		print	  qq`<p>The hashed version of the password you just entered is:</p><p>$hashed_password</p>`
			. qq`<p>Now open your prefs file and paste this hash into one of the `
			. qq`\n\$PREF{admin_password_hash*} or \$PREF{member_password_hash*} settings.</p>`;
		finish_html_output();
		
	}
	else
	{
		start_html_output('Enter your new password');
		print	  qq`<form method="post" action="$ENV{SCRIPT_NAME}?newpw" id="newpass">`
			. qq`\n<br /><br /><input type="password" name="password" maxlength="200" class="default text" />`
			. qq`\n<br /><br /><input type="submit" value="create hash" class="default button submit" />`
			. qq`\n</form>`;
		finish_html_output();
	}
}


sub user_is_allowed_to
{
	# TODO: these separate per-app branches can probably be partially or totally reconciled.

	if($PREF{internal_appname} eq 'userbase')
	{
		my $userid_performing_action = scalar(@_) == 1 ? $PREF{logged_in_userid} : shift; # if only 1 arg was passed, it's the action, implying we should automatically use the logged_in_userid.
		my $action = shift;
		my $user_affected_by_action = shift;
		my $userid_affected_by_action = get_user_id($user_affected_by_action);

		if($action eq 'edit_user_info')
		{
			return 1 if (logged_in_user_is_subgroup_manager()   &&   $userid_affected_by_action   &&   logged_in_subgroup_manager_owns_this_user($userid_affected_by_action));
		}

		foreach my $group (split(/\s*,\s*/, $PREF{"groups_not_allowed_to_$action"}))
		{
			return 0 if user_is_member_of_group($userid_performing_action, $group);
		}

		foreach my $group (split(/\s*,\s*/, $PREF{"groups_not_allowed_to_$action"}))
		{
			if($group =~ /^self$/i)
			{
				return 0 if ($PREF{member_is_logged_in}   &&   $userid_performing_action == $userid_affected_by_action);
			}
			else
			{
				return 0 if user_is_member_of_group($userid_performing_action, $group);
			}
		}

		foreach my $group (split(/\s*,\s*/, $PREF{"groups_allowed_to_$action"}))
		{
			if($group =~ /^self$/i)
			{
				return 1 if ($PREF{member_is_logged_in}   &&   $userid_performing_action == $userid_affected_by_action);
			}
			else
			{
				return 1 if user_is_member_of_group($userid_performing_action, $group);
			}
		}

		return 0;
	}
	else
	{
		my $action = shift;
		foreach my $group (split(/\s*,\s*/, $PREF{"groups_not_allowed_to_$action"}))
		{
			return 0 if user_is_member_of_group($PREF{logged_in_userid}, $group);
		}
		foreach my $group (split(/\s*,\s*/, $PREF{"groups_allowed_to_$action"}))
		{
			return 1 if user_is_member_of_group($PREF{logged_in_userid}, $group);
		}
		return 0;
	}
}


sub logged_in_user_is_part_of_a_subgroup()
{
	return 0 unless $PREF{member_is_logged_in};
	return user_is_part_of_a_subgroup($PREF{logged_in_userid});
}


sub user_is_part_of_a_subgroup($)
{
	#foreach my $group (enc_sql_select("SELECT "))
	#{
	#	if($group =~ /.+$PREF{subgroup_groupname_suffix}$/i)
	#	{
	#		return enc_sql_select("SELECT COUNT(*) FROM `$PREF{group_table}` WHERE LOWER(`group`) = LOWER('$group') AND `members` REGEXP '(^|,)$PREF{logged_in_userid}(,|\$)'");
	#	}
	#}

	my $uid = shift;
	return '' unless userbase_available();
	return $PREF{subgroup_manager_username} if exists $PREF{subgroup_manager_username}; # if this sub has already been called once, no need to re-do it.

	my $subgroup_groupname_suffix = $PREF{subgroup_groupname_suffix};
	sql_untaint($subgroup_groupname_suffix);
	exit_with_error("not SQL safe: \$subgroup_groupname_suffix ('$subgroup_groupname_suffix').") if not_sqlsafe($subgroup_groupname_suffix);

	die_unless_numeric($uid, '$uid');

	#return enc_sql_select("SELECT COUNT(*) FROM `$PREF{group_table}` WHERE `group` REGEXP '.+$subgroup_groupname_suffix\$' AND `members` REGEXP '(^|,)$uid(,|\$)'");
	#
	# 20111112: changing this to return the username of the SGM, rather than just
	# a zero or a number greater than zero, which doesn't change the true/false
	# value of the result, but makes it more useful:
	#
	my $subgroup = enc_sql_select("SELECT `group` FROM `$PREF{group_table}` WHERE `group` REGEXP '.+$subgroup_groupname_suffix\$' AND `members` REGEXP '(^|,)$uid(,|\$)'");
	$PREF{subgroup_manager_username} = ($subgroup =~ m!(.+)$subgroup_groupname_suffix$!)[0];
	$PREF{subgroup_manager_userid} = get_user_id($PREF{subgroup_manager_username}) if $PREF{subgroup_manager_username};
	return $PREF{subgroup_manager_username};
}


sub logged_in_user_is_subgroup_manager
{
	foreach my $group (split(/\s*,\s*/, $PREF{groups_that_can_manage_subgroup_users}))
	{
		return 1 if user_is_member_of_group($PREF{logged_in_userid}, $group);
	}
	return 0;
}


sub logged_in_subgroup_manager_owns_this_user($)
{
	my $userid_to_check = shift;
	return user_is_member_of_group($userid_to_check, "$PREF{logged_in_username}$PREF{subgroup_groupname_suffix}");
}


sub user_is_subgroup_manager
{
	my $username = shift;
	my $userid = get_user_id($username);
	foreach my $group (split(/\s*,\s*/, $PREF{groups_that_can_manage_subgroup_users}))
	{
		return 1 if user_is_member_of_group($userid, $group, 1);
	}
	return 0;
}


sub this_subgroup_manager_owns_this_user($$)
{
	my $subgroup_manager_userid = shift;
	my $userid_to_check = shift;
	my $subgroup_manager_username = get_user_name($subgroup_manager_userid);
	return user_is_subgroup_manager($subgroup_manager_username) && user_is_member_of_group($userid_to_check, "${subgroup_manager_username}$PREF{subgroup_groupname_suffix}");
}


sub exit_with_access_denied
{
	exit_with_needprivs();
}


##############################################################################
### Dispatch-FC: #############################################################
##############################################################################

load_prefs();

if($qs =~ /action=killkeepalive/)
{
	print "Cache-Control: no-store, no-cache\n";
	print "Content-type: text/html\n";
	print "Connection: close\n";
	print "\n";
	exit;
}
elsif($qs =~ /action=ajax_get_progress/)
{
	ajax_get_progress();
}
elsif($qs =~ /ajax_get_serial/)
{
	print_xml_headers();
	print qq`<?xml version="1.0" encoding="ISO-8859-1"?>\n<progress>\n<data>`;
	print generate_serial_number();
	print qq`</data>\n</progress>\n`;
}
elsif($qs =~ /ajax_do_humantest&fcht1=(.*?)&fcht2=(.*?)(?:&|$)/)
{
	my $passed_test = do_human_test($1,$2);

	print_xml_headers();
	print qq`<?xml version="1.0" encoding="ISO-8859-1"?>\n<progress>\n<data>`;
	print $passed_test ? 'passed=true' : 'passed=false';
	print qq`</data>\n</progress>\n`;
}
elsif($qs =~ /(?:^|&)eimsg([sne])=(\w+)(?:&|$)/)
{
	my ($type,$msg) = ($1,$TEXT{$2}); if($type eq 's') { exit_with_success($msg); } elsif($type eq 'n') { exit_with_notice($msg); } else { exit_with_error($msg); } 
}
elsif($qs =~ /(?:^|&)kmsg=(\w+)(?:&|$)/)
{
	exit_with_kmsg($1);
}
elsif($qs =~ /(?:^|&)smsg=(\w+)(?:&|$)/)
{
	exit_with_error($TEXT{The_password_you_entered_is_incorrect___}) if $1 eq 'failedlogin';
	exit_with_error($TEXT{"smsg_$1"}) if $TEXT{"smsg_$1"}; # for text strings that are entirely static, name them $TEXT{smsg_foo}.
}
elsif($qs =~ /(?:^|&)action=uploadcomplete(?:&|$)/)
{
	show_uploadcomplete_page();
}
elsif($qs =~ /(?:^|&)action=view_items(?:&|$)/)
{
	view_items();
}
elsif($qs =~ /(?:^|&)action=showperms&item=(.+?)(?:&|$)/)
{
	show_permissions($1);
}
elsif($qs =~ /(?:^|&)action=changeperms(?:&|$)/)
{
	change_permissions();
}
elsif($qs =~ /(?:^|&)action=process_order(?:&|$)/)
{
	process_order();
}
elsif($qs =~ /(?:^|&)action=showallperms(?:&|$)/)
{
	show_all_permissions();
}
elsif($qs =~ /(?:^|&)action=order_confirmation(?:&|$)/)
{
	order_confirmation();
}
elsif($qs =~ /(?:^|&)action=loggedout&whence=(.*)(?:&|$)/)
{
	# note that the whence regex is .* not .*? because the value
	# will likely contain ampersands that we want to keep.
	$PREF{member_is_logged_in} ? enc_redirect($PREF{here}) : show_loggedout_page($1);
}
elsif($qs =~ /action=delete(?:&path=(.*?))?&(file|folder)=(.+?)(?:&|$)/)
{
	my $error = delete_item($1,$2,$3); exit_with_error($error) if $error;
}
elsif($qs =~ /action=((?:move|rename)(?:copy)?)&(file|folder)=(.+?)&src=(.*?)(?:&dst=(.+?))?(?:&|$)/)
{
	move_item($1,$2,$3,$4,$5);
}
elsif($qs =~ /action=fileinfo&path=(.*?)&file=(.+?)(?:&|$)/)
{
	show_fileinfo($1, $2);
}
elsif($qs =~ /action=$PREF{upload_session_info_action_name}(?:&|$)/)
{
	show_upload_session_info();
}
elsif(get_qs_var('action') eq 'download')
{
	download_file();
}
elsif(get_qs_var('action') eq 'viewinline')
{
	download_file({ inline => 1 });
}
elsif($qs =~ /action=landing&path=(.*?)&file=(.+?)(?:&|$)/)
{
	show_download_landing_page($1, $2);
}
elsif($qs =~ /action=$PREF{mkdir_action_name}(?:&|$)/)
{
	make_dir();
}
elsif($qs =~ /action=unzip_files&path=(.*?)(?:&|$)/)
{
	unzip_files($1);
}
elsif($qs =~ /action=rotate_images(\d+)&path=(.*?)(?:&|$)/)
{
	rotate_images($1,$2);
}
elsif($qs =~ /action=delete_items&path=(.*?)(?:&|$)/)
{
	delete_items($1);
}
elsif($qs =~ /action=copy_items&path=(.*?)(?:&|$)/)
{
	copy_items($1);
}
elsif($qs =~ /action=multidownload&path=(.*?)(?:&|$)/)
{
	download_multiple_items($1);
}

elsif(get_qs_var('action') eq 'uploadlog')		{ show_upload_log(); }
elsif(get_qs_var('action') eq 'altuploadlog')		{ show_alternate_upload_log(); }
elsif(get_qs_var('action') eq 'downloadlog')		{ show_download_log(); }
elsif(get_qs_var('action') eq 'administration')		{ show_administration_menu(); }
elsif(get_qs_var('action') eq 'help')			{ show_help(); }
elsif(get_qs_var('action') eq 'config')			{ show_configuration(); }
elsif(get_qs_var('action') eq 'showprefs')		{ show_prefs(); }
elsif(get_qs_var('action') eq 'serverinfo')		{ show_server_info(); }
elsif(get_qs_var('action') eq 'imagemodules')		{ check_image_modules(); }
elsif(get_qs_var('action') eq 'viewer')			{ display_item_in_viewer(); }
elsif(get_qs_var('action') eq 'saleopts')		{ show_sale_options(); }

elsif($qs =~ /bounceback=(.+)/)
{
	# For when another app can't continue until FC does some sort of initialization (creating/populating userdirs, etc).
	my $go = $1; enc_urldecode($go); $go .= $go =~ /\?/ ? '&' : '?'; $go .= "bbdone=true"; enc_redirect($go);
}
elsif($qs =~ /action=incoming/i)
{
	process_upload();
}
elsif($qs =~ /(?:^|&)(list|action=listfiles)(?:&|$)/)
{
	list_uploaded_files();
}
elsif($qs =~ /(?:^|&)action=upload(?:&|$)/)
{
	print_new_upload_form();
}
elsif(   $qs =~ /do_email_test/   &&   ($PREF{enable_email_test} =~ /yes/i || $PREF{admin_is_logged_in})   )
{
	do_email_test();
}
elsif($qs =~ /(?:^|&)cpage=(\w+)/   &&   $PREF{custom_pages}{$1})
{
	show_custom_page($1);
}
else
{
	if($PREF{default_page} eq 'filelist')
	{
		list_uploaded_files();
	}
	else
	{
		print_new_upload_form();
	}
}
#printd "fcruntime=" . (gettimeofday() - $PREF{script_start_time_highres}) . "\n";