switched to sha() password encryption not using sha2 because of limitations of amarok, also added some caching and fixed some misc bugs

21 files changed, 178 insertions, 70 deletions

diff --git a/browse.php b/browse.php
index 85c3068e..ad3a3634 100644
--- a/browse.php
+++ b/browse.php
@@ -35,10 +35,10 @@ require_once 'lib/init.php';
 // so we've got a little switch here that creates the type.. this feels hackish...
 
 switch ($_REQUEST['action']) { 
+	case 'tag': 
 	case 'file': 
 	case 'album': 
 	case 'artist': 
-	case 'genre': 
 	case 'playlist': 
 	case 'live_stream': 
 	case 'song': 
@@ -59,17 +59,18 @@ switch($_REQUEST['action']) {
 		Album::build_cache($album_ids); 
 		Browse::show_objects($album_ids); 
 	break;
+	case 'tag': 
+		Browse::set_sort('count','ASC'); 
+		$tags = Browse::get_objects(); 
+		Tag::build_cache($tags); 
+		Browse::show_objects($tags); 
+	break; 
 	case 'artist':
 		Browse::set_sort('name','ASC');
 		$artist_ids = Browse::get_objects(); 
 		Artist::build_cache($artist_ids); 
 		Browse::show_objects($artist_ids); 
 	break;
-	case 'genre':
-		Browse::set_sort('name','ASC');
-		$genre_ids = Browse::get_objects(); 
-		Browse::show_objects($genre_ids); 
-	break;
 	case 'song':
 		Browse::set_sort('title','ASC');
 		$song_ids = Browse::get_objects(); 
diff --git a/docs/CHANGELOG b/docs/CHANGELOG
index 823fe5d6..28e59d1a 100755
--- a/docs/CHANGELOG
+++ b/docs/CHANGELOG
@@ -4,6 +4,10 @@
 
 --------------------------------------------------------------------------
   v.3.5-Alpha1
+	- Fixed home menu not always displaying the entire contents
+	- Fixed logic error with duplicate login setting which caused it
+		to only work if mysql auth was used
+	- Changed Passwords to SHA1 will prompt to reset password
         - Corrected some translation strings and added jp_JP (Thx momo-i)
 	- Ignore filenames that start with . (hidden) solves an issue
 		with mac filesystems
diff --git a/index.php b/index.php
index c8274937..76453e98 100644
--- a/index.php
+++ b/index.php
@@ -32,7 +32,7 @@ $action = scrub_in($_REQUEST['action']);
  */
 if (Config::get('refresh_limit') > 5) { 
 	$refresh_limit = Config::get('refresh_limit'); 
-	$ajax_url = Config::get('ajax_url') . '?action=reloadnp';
+	$ajax_url = Config::get('ajax_url') . '?page=index&action=reloadnp';
 	require_once Config::get('prefix') . '/templates/javascript_refresh.inc.php';
 }
 
diff --git a/lib/class/browse.class.php b/lib/class/browse.class.php
index 3cb06b5b..750ea4c7 100644
--- a/lib/class/browse.class.php
+++ b/lib/class/browse.class.php
@@ -195,7 +195,7 @@ class Browse {
 			case 'catalog':
 			case 'album':
 			case 'artist':
-			case 'genre':
+			case 'tag':
 			case 'shoutbox': 
 			case 'live_stream':
 				// Set it
diff --git a/lib/class/catalog.class.php b/lib/class/catalog.class.php
index e518c5b8..723d7c55 100644
--- a/lib/class/catalog.class.php
+++ b/lib/class/catalog.class.php
@@ -502,7 +502,7 @@ class Catalog {
 
 				// Check to make sure the filename is of the expected charset
 				if (function_exists('iconv')) { 
-					if (strcmp($full_file,iconv(Config::get('site_charset'),Config::get('site_charset') . '//IGNORE',$full_file)) != '0') { 
+					if (strcmp($full_file,iconv(Config::get('site_charset'),Config::get('site_charset'),$full_file)) != '0') { 
 						debug_event('read',$full_file . ' has non-' . Config::get('site_charset') . ' characters and can not be indexed','1'); 
 						Error::add('catalog_add',$full_file . ' ' . _('does not match site charset')); 
 						continue; 
diff --git a/lib/class/dba.class.php b/lib/class/dba.class.php
index 4f97f6db..7cee79ed 100644
--- a/lib/class/dba.class.php
+++ b/lib/class/dba.class.php
@@ -68,6 +68,28 @@ class Dba {
 	} // query
 
 	/**
+	 * read
+	 * This is a wrapper for query, it's so that in the future if we ever wanted
+	 * to split reads and writes we could
+	 */
+	public static function read($sql) { 
+
+		return self::query($sql); 
+
+	} // read
+
+	/**
+	 * write
+	 * This is a wrapper for a write query, it is so that we can split out reads and
+	 * writes if we want to 
+	 */
+	public static function write($sql) { 
+
+		return self::query($sql); 
+
+	} // write
+
+	/**
 	 * escape
 	 * This runs a escape on a variable so that it can be safely inserted
 	 * into the sql 
diff --git a/lib/class/error.class.php b/lib/class/error.class.php
index 13f96882..2c4679ec 100644
--- a/lib/class/error.class.php
+++ b/lib/class/error.class.php
@@ -27,8 +27,8 @@
  */
 class Error { 
 
-	public static $state = false; // set to one when an error occurs
-	public static $errors = array(); // Errors array key'd array with errors that have occured
+	private static $state = false; // set to one when an error occurs
+	private static $errors = array(); // Errors array key'd array with errors that have occured
 
 	/**
 	 * __constructor
@@ -81,6 +81,18 @@ class Error {
 
 	} // add
 
+	/**	
+	 * occurred
+	 * This returns true / false if an error has occured anywhere
+	 */
+	public static function occurred() { 
+
+		if (self::$state == '1') { return true; } 
+
+		return false; 
+
+	} // occurred
+
 	/**
 	 * get
 	 * This returns an error by name
diff --git a/lib/class/rating.class.php b/lib/class/rating.class.php
index 6d89b8fb..5d2f9bf2 100644
--- a/lib/class/rating.class.php
+++ b/lib/class/rating.class.php
@@ -64,26 +64,26 @@ class Rating extends database_object {
 	 * //FIXME: Improve logic so that misses get cached as average
 	 */
 	public static function build_cache($type, $ids) {
-	
+		
 		$user_id = Dba::escape($GLOBALS['user']->id); 
 
 		$idlist = '(' . implode(',', $ids) . ')';
 		$sql = "SELECT `rating`, `object_id`,`rating`.`rating` FROM `rating` WHERE `user`='$user_id' AND `object_id` IN $idlist " . 
 			"AND `object_type`='$type'";
-		$db_results = Dba::query($sql);
+		$db_results = Dba::read($sql);
 
 		while ($row = Dba::fetch_assoc($db_results)) {
 			$user[$row['object_id']] = $row['rating']; 
 		}
 		
 		$sql = "SELECT `rating`,`object_id` FROM `rating` WHERE `object_id` IN $idlist AND `object_type`='$type'"; 
-		$db_results = Dba::query($sql); 
+		$db_results = Dba::read($sql); 
 		
 		while ($row = Dba::fetch_assoc($db_results)) { 
 			$rating[$row['object_id']]['rating'] += $row['rating']; 
 			$rating[$row['object_id']]['total']++; 
   		} 
-		
+
 		foreach ($ids as $id) { 
 			parent::add_to_cache('rating_' . $type . '_user',$id,intval($user[$id])); 
 
diff --git a/lib/class/song.class.php b/lib/class/song.class.php
index 806a81f9..b73ab1e8 100644
--- a/lib/class/song.class.php
+++ b/lib/class/song.class.php
@@ -86,7 +86,7 @@ class Song extends database_object {
 				"addition_time FROM `song` " .
 				"LEFT JOIN `tag_map` ON `tag_map`.`object_id`=`song`.`id` AND `tag_map`.`object_type`='song' " . 
 				"WHERE `song`.`id` IN $idlist";
-		$db_results = Dba::query($sql);
+		$db_results = Dba::read($sql);
 	  
 		while ($row = Dba::fetch_assoc($db_results)) {
 			parent::add_to_cache('song',$row['id'],$row); 
@@ -100,9 +100,14 @@ class Song extends database_object {
 		Tag::build_cache($tags); 
 		Tag::build_map_cache('song',$song_ids); 
 
+		// If we're rating this then cache them as well
+		if (Config::get('ratings')) { 
+			Rating::build_cache('song',$song_ids); 
+		} 
+
 		// Build a cache for the song's extended table
 		$sql = "SELECT * FROM `song_data` WHERE `song_id` IN $idlist"; 
-		$db_results = Dba::query($sql); 
+		$db_results = Dba::read($sql); 
 
 		while ($row = Dba::fetch_assoc($db_results)) { 
 			parent::add_to_cache('song_data',$row['song_id'],$row); 
diff --git a/lib/class/user.class.php b/lib/class/user.class.php
index 2cdcf251..4d50f5ba 100644
--- a/lib/class/user.class.php
+++ b/lib/class/user.class.php
@@ -360,7 +360,7 @@ class User extends database_object {
 			Error::add('password',_("Error Passwords don't match")); 
 		} 
 
-		if (Error::$state) { 
+		if (Error::occurred()) { 
 			return false; 
 		} 
 		
@@ -593,7 +593,7 @@ class User extends database_object {
 		/* Now Insert this new user */
 		$sql = "INSERT INTO `user` (`username`, `fullname`, `email`, `password`, `access`, `create_date`) VALUES" .
 			" ('$username','$fullname','$email',PASSWORD('$password'),'$access','" . time() ."')";
-		$db_results = Dba::query($sql);
+		$db_results = Dba::write($sql);
 		
 		if (!$db_results) { return false; }
 
@@ -613,9 +613,11 @@ class User extends database_object {
 	 */
 	public function update_password($new_password) { 
 
+		$new_password = hash('sha1',$new_password); 
+
 		$new_password = Dba::escape($new_password);
-		$sql = "UPDATE `user` SET `password`=PASSWORD('$new_password') WHERE `id`='$this->id'";
-		$db_results = Dba::query($sql);
+		$sql = "UPDATE `user` SET `password`='$new_password' WHERE `id`='$this->id'";
+		$db_results = Dba::write($sql);
 
 	} // update_password 
 
@@ -641,7 +643,7 @@ class User extends database_object {
 		/* Calculate their total Bandwidth Useage */
 		$sql = "SELECT `song`.`size` FROM `song` LEFT JOIN `object_count` ON `song`.`id`=`object_count`.`object_id` " . 
 			"WHERE `object_count`.`user`='$this->id' AND `object_count`.`object_type`='song'";
-		$db_results = Dba::query($sql);
+		$db_results = Dba::read($sql);
 
 		while ($r = Dba::fetch_assoc($db_results)) { 
 			$total = $total + $r['size'];
diff --git a/lib/class/vauth.class.php b/lib/class/vauth.class.php
index 400edf6d..c6189250 100644
--- a/lib/class/vauth.class.php
+++ b/lib/class/vauth.class.php
@@ -462,21 +462,59 @@ class vauth {
 	} // authenticate
 
 	/**
- 	 * mysql_auth
-	 * This is a private function, it should only be called by authenticate
+	 * mysql_auth
+	 * This is the core function of authentication by ampache. It checks their current password
+	 * and then tries to figure out if it can use the new SHA password hash or if it needs to fall
+	 * back on the mysql method
 	 */
 	private static function mysql_auth($username,$password) { 
 
-	        $username = Dba::escape($username);
-	        $password = Dba::escape($password);
+		$username = Dba::escape($username); 
+		$password = Dba::escape($password); 
 
-	        $password_check_sql = "PASSWORD('$password')";
+		if (!strlen($password) OR !strlen($username)) { 
+			Error::add('general',_('Error Username or Password incorrect, please try again')); 
+			return false; 
+		} 
 
-	        // If they don't have a password kick em ou
-	        if (!strlen($password)) {
-	                Error::add('general','Error Username or Password incorrect, please try again');
-	                return false;
-	        }
+		// We have to pull the password in order to figure out how to handle it *cry*
+		$sql = "SELECT `password` FROM `user` WHERE `username`='$username'"; 
+		$db_results = Dba::read($sql); 
+		$row = Dba::fetch_assoc($db_results); 
+
+		// If it's using the old method then roll with that
+		if (substr($row['password'],0,1) == '*' OR strlen($row['password']) < 32) { 
+			$response = self::vieux_mysql_auth($username,$password); 
+			return $response; 
+		} 
+
+		// Use SHA1 for the password, we aren't using SHA2 because Amarok can't handle it *cry*
+		$password = hash('sha1',$password); 
+	
+		$sql = "SELECT `username`,`id` FROM `user` WHERE `password`='$password' AND `username`='$username'"; 	
+		$db_results = Dba::read($sql); 
+
+		$row = Dba::fetch_assoc($db_results); 
+
+		if (!count($row)) { 
+			Error::add('general',_('Error Username or Password incorrect, please try again')); 
+			return false; 
+		} 
+
+                $row['type']        = 'mysql';
+                $row['success']     = true;
+
+		return $row;
+
+	} // mysql_auth
+
+	/**
+ 	 * vieux_mysql_auth
+	 * This is a private function, it should only be called by authenticate
+	 */
+	private static function vieux_mysql_auth($username,$password) { 
+
+		$password_check_sql = "PASSWORD('$password')";
 
 		// This has to still be here because lots of people use old_password in their config file
 		$sql = "SELECT `password` FROM `user` WHERE `username`='$username'"; 
@@ -498,7 +536,7 @@ class vauth {
 	        $results = Dba::fetch_assoc($db_results);
 
 	        if (!$results) {
-	                Error::add('general','Error Username or Password incorrect, please try again');
+	                Error::add('general',_('Error Username or Password incorrect, please try again'));
 	                return false;
 	        }
 
@@ -512,11 +550,12 @@ class vauth {
 	        } // if prevent_multiple_logins
 
 	        $results['type']        = 'mysql';
+		$results['password']	= 'old'; 
 	        $results['success']     = true;
 
 	        return $results;
 
-	} // mysql_auth
+	} // vieux_mysql_auth
 
 	/**
 	 * ldap_auth
diff --git a/login.php b/login.php
index 9bf8f87f..cc402cc8 100644
--- a/login.php
+++ b/login.php
@@ -99,13 +99,23 @@ if ($_POST['username'] && $_POST['password']) {
 
 /* If the authentication was a success */
 if ($auth['success']) {
+
+	// Generate the user we need for a few things
+	$user = User::get_from_username($username);
+
+	if (Config::get('prevent_multiple_logins')) {
+		$current_ip = $user->is_logged_in();
+		if ($current_ip != sprintf("%u",ip2long($_SERVER['REMOTE_ADDR']))) {
+			Error::add('general',_('User Already Logged in'));
+			require Config::get('prefix') . '/templates/show_login_form.inc.php';
+			exit; 
+        	}
+	} // if prevent_multiple_logins
+
 	// $auth->info are the fields specified in the config file
 	//   to retrieve for each user
 	vauth::session_create($auth);
 	
-	// Generate the user we need for a few things
-	$user = User::get_from_username($username);
-
 	//
 	// Not sure if it was me or php tripping out,
 	//   but naming this 'user' didn't work at all
diff --git a/preferences.php b/preferences.php
index 1962210e..9c28ed96 100644
--- a/preferences.php
+++ b/preferences.php
@@ -28,6 +28,11 @@ switch($_REQUEST['action']) {
 			access_denied(); 
 			exit; 
 		} 
+
+		if (!Core::form_verify('update_preferences','post')) { 
+			access_denied(); 
+			exit; 
+		} 
 		
 		/* Reset the Theme */
 		if ($_REQUEST['method'] == 'admin') { 
@@ -53,6 +58,11 @@ switch($_REQUEST['action']) {
 			exit; 
 		} 
 
+                if (!Core::form_verify('update_preferences','post')) {
+                        access_denied();
+                        exit;
+                }
+
 		update_preferences($_REQUEST['user_id']); 
 		header("Location: " . Config::get('web_path') . "/admin/users.php?action=show_preferences&user_id=" . scrub_out($_REQUEST['user_id'])); 
 	break;
@@ -76,10 +86,16 @@ switch($_REQUEST['action']) {
 	break; 
 	case 'update_user': 
 		// Make sure we're a user and they came from the form
-		if (!Access::check('interface','25') || $_POST['form_string'] != $_SESSION['forms']['account'] || !strlen($_SESSION['forms']['account'])) { 
+		if (!Access::check('interface','25')) { 
 			access_denied(); 
 			exit; 
 		} 
+
+                if (!Core::form_verify('update_user','post')) {
+                        access_denied();
+                        exit;
+                }
+
 		// Remove the value
 		unset($_SESSION['forms']['account']); 
 
diff --git a/register.php b/register.php
index 772d71f2..46bb3783 100644
--- a/register.php
+++ b/register.php
@@ -131,7 +131,7 @@ switch ($_REQUEST['action']) {
 		}
 
 		// If we've hit an error anywhere up there break!
-		if (Error::$state) {
+		if (Error::occurred()) {
 			require_once Config::get('prefix') . '/templates/show_user_registration.inc.php';
 			break;
 		}
diff --git a/server/ajax.server.php b/server/ajax.server.php
index 5e586895..5a7a8f7d 100644
--- a/server/ajax.server.php
+++ b/server/ajax.server.php
@@ -293,21 +293,6 @@ switch ($_REQUEST['action']) {
 		
 		$results['rightbar'] = ajax_include('rightbar.inc.php'); 
 	break;
-	/* reloading the now playing information */
-	case 'reloadnp':
-		ob_start();
-		show_now_playing();	
-		$results['now_playing'] = ob_get_contents();
-		ob_clean();
-		$data = Song::get_recently_played(); 
-		if (count($data)) { 
-			show_box_top(_('Recently Played')); 
-			require_once Config::get('prefix') . '/templates/show_recently_played.inc.php'; 
-			show_box_bottom(); 
-		}
-		$results['recently_played'] = ob_get_contents(); 
-		ob_end_clean();
-	break;
 	/* Setting ratings */
 	case 'set_rating':
 		ob_start(); 
diff --git a/server/index.ajax.php b/server/index.ajax.php
index e8029de2..2573e7d2 100644
--- a/server/index.ajax.php
+++ b/server/index.ajax.php
@@ -30,10 +30,23 @@ switch ($_REQUEST['action']) {
 		if (count($albums)) { 
 			ob_start(); 
 			require_once Config::get('prefix') . '/templates/show_random_albums.inc.php'; 
-			$results['random_selection'] = ob_get_contents(); 
-			ob_end_clean(); 
+			$results['random_selection'] = ob_get_clean(); 
 		} 
 	break;
+	case 'reloadnp': 
+		ob_start(); 
+		show_now_playing(); 
+		$results['now_playing'] = ob_get_clean(); 
+		ob_start(); 
+		$data = Song::get_recently_played(); 
+		Song::build_cache(array_keys($data)); 
+		if (count($data)) { 
+			show_box_top(_('Recently Played')); 
+                        require_once Config::get('prefix') . '/templates/show_recently_played.inc.php';
+			show_box_bottom(); 
+		} 
+		$results['recently_played'] = ob_get_clean(); 
+	break; 
 	case 'sidebar': 
                 switch ($_REQUEST['button']) {
                         case 'home':
diff --git a/templates/footer.inc.php b/templates/footer.inc.php
index cef63c28..38090bfb 100644
--- a/templates/footer.inc.php
+++ b/templates/footer.inc.php
@@ -21,9 +21,10 @@
 */
 ?>
 <div style="clear:both;"></div>
+<?php if ($_SESSION['userdata']['password'] == 'old') {?>
+	<span class="fatalerror"><?php echo _('Using Old Password Encryption, Please Reset your Password'); ?></span>
+<?php } ?>
 </div> <!-- end id="content"-->
-<!-- I really hate IE
-</td></tr></table> -->
 </div> <!-- end id="maincontainer"-->
 <div id="footer">
 	<a href="http://www.ampache.org/index.php">Ampache v.<?php echo Config::get('version'); ?></a><br />
diff --git a/templates/show_account.inc.php b/templates/show_account.inc.php
index 256898f7..eb371443 100644
--- a/templates/show_account.inc.php
+++ b/templates/show_account.inc.php
@@ -1,7 +1,7 @@
 <?php
 /*
 
- Copyright (c) 2001 - 2007 Ampache.org
+ Copyright (c) Ampache.org
  All rights reserved.
 
  This program is free software; you can redistribute it and/or
@@ -19,10 +19,9 @@
 
 */
 // Because this is a reset of the persons password make the form a little more secure
-$form_string = generate_password('32'); 
-$_SESSION['forms']['account'] = $form_string; 
 ?>
 <?php Error::display('general'); ?>
+<form method="post" name="preferences" action="<?php echo Config::get('web_path'); ?>/preferences.php?action=update_user" enctype="multipart/form-data">
 <table class="tabledata">
 <tr>
 	<td><?php echo _('Name'); ?>:</td>
@@ -58,8 +57,7 @@ $_SESSION['forms']['account'] = $form_string;
 </table>
 <div class="formValidation">
 		<input type="hidden" name="user_id" value="<?php echo scrub_out($client->id); ?>" />
-		<input type="hidden" name="action" value="update_user" />
+		<?php echo Core::form_register('update_user'); ?>
 		<input type="hidden" name="tab" value="<?php echo scrub_out($_REQUEST['tab']); ?>" />
-		<input type="hidden" name="form_string" value="<?php echo $form_string; ?>" />
 		<input class="button" type="submit" value="<?php echo _('Update Account'); ?>" />
 </div>
diff --git a/templates/show_index.inc.php b/templates/show_index.inc.php
index 605b4d42..497b1b3b 100644
--- a/templates/show_index.inc.php
+++ b/templates/show_index.inc.php
@@ -41,6 +41,7 @@
 <div id="recently_played">
         <?php
                 $data = Song::get_recently_played();
+		Song::build_cache(array_keys($data)); 
 		show_box_top(_('Recently Played')); 
                 require_once Config::get('prefix') . '/templates/show_recently_played.inc.php'; 
 		show_box_bottom(); 
diff --git a/templates/show_preferences.inc.php b/templates/show_preferences.inc.php
index af331ab4..89fe61b8 100644
--- a/templates/show_preferences.inc.php
+++ b/templates/show_preferences.inc.php
@@ -26,17 +26,16 @@
 
 ?>
 <?php show_box_top(_('Editing') . ' ' . $fullname . ' ' . _('preferences'),'box box_preferences'); ?>
-<form method="post" name="preferences" action="<?php echo Config::get('web_path'); ?>/preferences.php?action=update_preferences" enctype="multipart/form-data">
-<?php 
-if ($_REQUEST['tab'] != 'account' && $_REQUEST['tab'] != 'modules') { 
-	show_preference_box($preferences[$_REQUEST['tab']]); 
+<?php  if ($_REQUEST['tab'] != 'account' && $_REQUEST['tab'] != 'modules') { ?>
 
-?>
+<form method="post" name="preferences" action="<?php echo Config::get('web_path'); ?>/preferences.php?action=update_preferences" enctype="multipart/form-data">
+<?php show_preference_box($preferences[$_REQUEST['tab']]);  ?>
 <div class="formValidation">
 	<input class="button" type="submit" value="<?php echo _('Update Preferences'); ?>" />
+	<?php echo Core::form_register('update_preference'); ?>
 	<input type="hidden" name="tab" value="<?php echo scrub_out($_REQUEST['tab']); ?>" />
 	<input type="hidden" name="method" value="<?php echo scrub_out($_REQUEST['action']); ?>" />
-	<?php if ($GLOBALS['user']->has_access('100')) { ?>
+	<?php if (Access::check('interface','100')) { ?>
 		<input type="hidden" name="user_id" value="<?php echo scrub_out($_REQUEST['user_id']); ?>" />
 	<?php } ?>
 </div>
diff --git a/templates/sidebar_home.inc.php b/templates/sidebar_home.inc.php
index 1a44da06..ed059ece 100644
--- a/templates/sidebar_home.inc.php
+++ b/templates/sidebar_home.inc.php
@@ -70,6 +70,7 @@ $ajax_info = Config::get('ajax_url'); $web_path = Config::get('web_path');
         <?php } // if playlist_type ?>
     </div>
   </li>
+<?php } ?>
   <li><h4><?php echo _('Playlist'); ?></h4>
     <ul class="sb3" id="sb_home_info">
       <li id="sb_home_info_CurrentlyPlaying"><a href="<?php echo $web_path; ?>/index.php"><?php echo _('Currently Playing'); ?></a></li>
@@ -95,5 +96,4 @@ $ajax_info = Config::get('ajax_url'); $web_path = Config::get('web_path');
       <li id="sb_home_random_advanced"><a href="<?php echo $web_path; ?>/random.php?action=advanced"><?php echo _('Advanced'); ?></a></li>
     </ul>
   </li>
-<?php } ?>
 </ul>