Turns out these were not the cause of a problem I had with PHP5, but they
should be fixed anyway.

deleted, they still remain in the user table with a status of
"archived", but since all the queries in the system now use uid_idx
instead of uid, it is safe to reuse a uid since they are no longer
ambiguous. 

The reason for not deleting users from the users table is so that the
stats records can refer to the original record (who was that person
named "mike"). This is very handy and worth the additional effort it
has taken.

There is no way to ressurect a user, but it would not be hard to add.

Got tired of looking in the DB.

redirect to the login page rather than printing a message with a link
to the page.  Otherwise send a "403 Forbidden" to keep robots from
indexing the page.  Also send appreciate HTTP responses on other
precheck errors to keep a robot from indexing the page.  In order to
do this the PAGEHEADER call needed to be moved to after
CheckLoginOrDie and Required/OptionalPageArguments on many pages.  A
warning will be printed if either CheckLoginOrDie or
Required/OptionalPageArguments detects that PAGEHEADER was already
called.

Also change the redirect in kb-show to be a permanent redirect (301)
rather than a temporary one (302) which is the default unless a status
code is given.

Set the charset for all emulab pages to utf-8 which is needed to
display foreign names correctly.  Also added three rows to table_regex:
tinytext_utf8, text_utf8, fulltext_utf8

Enhanced form_defs.php:

  - Add Support for Textarea

  - Add Support for a vertical list, for example see Category in
    submitpub.php

  - Add support for dumping the form values in plain text, used in the
    email I send to testbed-ops.

  - Change Error Reporting text for subfields such as in a list so
    they also include the text from the outer field, for example in
    newosid "ping" will become "OS Features, ping".  I needed this
    since some of my subfields didn't have labels and it seamed like
    the right thing to do.

  - Set #return_value to 1 in FormRenderCheckBox if it not already
    specified

  - In FormRenderSelect, if the #value is not in the list add it to
    the end.

  - Add support for "display" type, to just display some text in the
    table

  - Possibly some other little things I forgot about.

...

good work Red Team!

classnames).

and " since the value never goes near a query without being sanitized.

sandbox, and that I did. It falls back to the older archive when
the template is older then CVS repos.

But along the way I got annoyed with the fact that template instantiation
does not provide a logfile to the web interface. The reason is that
the current logfile stuff is very experiment centric; there has to be an
experiment and an attached logfile. An instance does not have an experiment
until really late in the game so the code was just not bothering.

Anyway, I've started to generalize the logfile stuff with a new table
and the approach that a logfile is named by a random key, and if you
know the key you can look at the logfile in the web (since without an
experiment it is hard to do permission checks unless we make logfiles
uid/gid owned, and I did not want to do that.

of changes to the new form wrapper stuff to support more interesting
forms.

cvs repo from the template show page.

emulab data.  Many of the search knobs are already in place, but need to
couple them with a UI.

* Records are now "help open" when a run is stopped. When the next run
  is started, a check is made to see if the files
  (/project/$pid/exp/$eid) have changed, and if so a new version of the
  archive is committed before the next run is started.

* Change the way swapmod is handled within an instance. A new option
  on the ShowExp page called Modify Resources. The intent is to allow
  an instance to be modified without having to start and stop runs,
  which tends to clutter things up, according to our user base. So, if
  you are within a run, that run is reset (reused) after the swapmod is
  finished. You can do this as many times as you like. If you are
  between runs (last operation was a stoprun), do the swapmod and then
  "speculatively" start a new run. Subsequent modifies reuse the that
  run again, as above.

  I think this is what Kevin was after ... there are some UI issues
  that may need to be resolved, will wait to hear what people have to
  say.

* Revising a record is now supported. Export, change in place, and
  then use the Revise link on the ShowRun page. Currently this has to
  happen from the export directory on ops, but eventually allow an
  upload (to correspond to downloaded exports)

* Check to see if export already exists, and give warning. Added a
  checkbox that allows user to overwrite the export.

* A bunch of minor UI changes to the various template pages.

Other stuff leaked in too ...

I did separate out a lot of tbsetup/libArchive into db/Archive, and
whats left in libArchive.pm will eventually move over into the
Template library.

Note that I have dropped archiving of plain experiments; this is not
really owrth it outside the workbench context, and it just wastes
space and makes a lot if stuff painful in the web interface.

  register_globals=1 to turn POST/GET/COOKIES arguments in local variables.
  This is known to be a terrible security risk, and we keep saying we are
  going to fix it, and now I am. In order to accomplish this on a
  transitional basis (since I don't want the entire web interface to stop
  working while I debug it), and because the code just needs the cleanup, I
  am doing it like this: Each page will sport new declarations at the top:

	RequiredPageArguments("experiment", PAGEARG_EXPERIMENT,
                              "template",   PAGEARG_TEMPLATE,
                              "instance",   PAGEARG_INSTANCE,
                              "metadata",   PAGEARG_METADATA,
                              "osinfo",     PAGEARG_OSINFO,
                              "image",      PAGEARG_IMAGE,
                              "project",    PAGEARG_PROJECT,
                              "group",      PAGEARG_GROUP,
                              "user",       PAGEARG_USER,
			      "node",       PAGEARG_NODE,
			      "yesno",      PAGEARG_BOOLEAN,
			      "message",    PAGEARG_STRING,
			      "age",        PAGEARG_INTEGER,
                              "cost",       PAGEARG_NUMERIC,
                              "formfields", PAGEARG_ARRAY,
                              "unknown",    PAGEARG_ANYTHING);

	OptionalPageArguments("canceled", PAGEARG_BOOLEAN);

  The first token in each pair is the name of the global variable to
  set, and the second token is the type. So, for "experiment" we look at
  the URL for a pid/eid or exptidx, etc, sanity check them (safe for a
  DB query), and then try to find that experiment in the DB. If it maps
  to an experiment, set global variable $experiment to the object. Since
  its a required argument, produce an error if not supplied. Similar
  treatment for optional arguments, with the obvious difference.

  The goal is to have ALL argument processing in one place, consistent,
  and correct. I've found numerous places where we leak unchecked
  arguments into queries. It also cuts out a lot of duplicated code.

* To make the above easier to deal with, I've been replacing lots of
  hardcoded URLS in the code of the form:

	foo.php3?pid=$pid&eid=$eid ...

  with

        CreateURL("foo", $experiment)

  which creates and returns the neccessary url string, by looking at
  the type of its arguments (experiment, template, instance, etc.)

  Eventually plan to replace them all so that URL handling throughout
  the code is all defined in one place (all the new URL code is in
  url_defs.php).

* I have cranked up error reporting to tell me anytime a variable is
  used before it is initialized, plus a bunch of other stuff that PHP
  deems improper. Think of it like -Wall ... and boy we get a lot of
  warnings.  A very large percentage of the diffs are to fix all these
  warnings.

  The warnings are currently going to /usr/testbed/log/php-errors.log,
  and I'll be adding a script to capture them each night and mail them
  to tbops. This file also gets errors (this will be a change for
  developers; rather then seeing errors and warnings dumped in the
  middle of web pages, they will go to this file instead).

* Major refactoring of the code. More objects (nodes, images, osids).
  Moving tons of queries into the objects in the hopes of someday
  getting to a point where we can split the web interface onto a
  different server.  Lots of general cleanup.

converting to locally unique ids and later globally unique ids.