From: Paul Hänsch <paul@plutz.net>
Date: Fri, 3 Mar 2023 15:04:22 +0000 (+0100)
Subject: Merge commit 'cff53799749855b8ce29e822096a682accdae5a5'
X-Git-Url: http://git.plutz.net/?a=commitdiff_plain;h=af0b91f324f4bce9db9a52cc4ae2a47f214382b6;hp=-c;p=confetti

Merge commit 'cff53799749855b8ce29e822096a682accdae5a5'
---

af0b91f324f4bce9db9a52cc4ae2a47f214382b6
diff --combined cgilite/.gitignore
index 0000000,5c9950a..5c9950a
mode 000000,100644..100644
--- a/cgilite/.gitignore
+++ b/cgilite/.gitignore
@@@ -1,0 -1,3 +1,3 @@@
+ cgilite
+ serverkey
+ users.db
diff --combined cgilite/cgilite.sh
index f766ee2,b51ee8e..b51ee8e
--- a/cgilite/cgilite.sh
+++ b/cgilite/cgilite.sh
@@@ -1,6 -1,6 +1,6 @@@
  #!/bin/sh
  
- # Copyright 2017 - 2020 Paul Hänsch
+ # Copyright 2017 - 2021 Paul Hänsch
  #
  # This is CGIlite.
  # A collection of posix shell functions for writing CGI scripts.
@@@ -25,13 -25,41 +25,41 @@@
  # set -o posix # ksh, not portable
  setopt -o OCTAL_ZEROES 2>&-
  
+ # Integrated webserver request timeout
+ cgilite_timeout=2
+ 
+ # General environment variables
+ # $_EXEC - directory containing application itself
+ # $_DATA - direcotry where application data may be stored
+ # $_BASE - optional prefix for http path, e.g. "/myapp"
+ #
+ # Programmers should take care to use those variables throughout the
+ # application.
+ # Variables may be set via CLI argument, in environment, or left as default.
+ 
+ for cgilite_arg in "$@"; do case $cgilite_arg in
+   --exec=*) _EXEC="${cgilite_arg#*=}";;
+   --data=*) _DATA="${cgilite_arg#*=}";;
+   --base=*) _BASE="${cgilite_arg#*=}";;
+ esac; done
+ unset cgilite_arg
+ 
+ _EXEC="${_EXEC:-${0%/*}}"
+ _DATA="${_DATA:-.}"
+ _EXEC="${_EXEC%/}" _DATA="${_DATA%/}" _BASE="${_BASE%/}"
+ 
+ export _EXEC _DATA _BASE
+ 
+ # Carriage Return and Line Break characters for convenience
  CR="
"
  BR='
  '
- cgilite_timeout=2
  
  PATH(){ 
    local str seg out
+   # normalize path
+   # read from stdin if no arguments are provided
+ 
    [ $# -eq 0 ] && str="$(cat)" || str="$*"
    while [ "$str" ]; do
      seg=${str%%/*}; str="${str#*/}"
@@@ -45,18 -73,59 +73,59 @@@
    [ "${str}" -a "${out}" ] && printf %s "$out" || printf %s/ "${out%/}"
  }
  
- HEX_DECODE='
-   s;\\;\\\\;g; :HEXDECODE_X; s;%([^0-9A-F]);\\045\1;g; tHEXDECODE_X;
-   # Hexadecimal { %00 - %FF } will be transformed to octal { \000 - \377 } for posix printf
-   s;%[0123].;&\\0;g; s;%[4567].;&\\1;g; s;%[89AB].;&\\2;g; s;%[CDEF].;&\\3;g;
-   s;%[048C][0-7]\\.;&0;g; s;%[048C][89A-F]\\.;&1;g; s;%[159D][0-7]\\.;&2;g; s;%[159D][89A-F]\\.;&3;g;
-   s;%[26AE][0-7]\\.;&4;g; s;%[26AE][89A-F]\\.;&5;g; s;%[37BF][0-7]\\.;&6;g; s;%[37BF][89A-F]\\.;&7;g;
-   s;%.[08](\\..);\10;g; s;%.[19](\\..);\11;g; s;%.[2A](\\..);\12;g; s;%.[3B](\\..);\13;g;
-   s;%.[4C](\\..);\14;g; s;%.[5D](\\..);\15;g; s;%.[6E](\\..);\16;g; s;%.[7F](\\..);\17;g;
- '
- 
  HEX_DECODE(){
-   printf -- "$(printf %s "$1" |sed -E "$HEX_DECODE")"
+   local pfx="$1" in="$2" out
+   # Print out Data encoded as Hex
+   #
+   # Arguments:
+   # pfx - required, prefix for a hex tupel, e.g. "\x", "%" "\", may be empty
+   # in - required, string to be decoded
+   #
+   # anything that does not constitute a tupel of valid Hex numerals
+   # will be copied to the output literally
+ 
+   while [ "$in" ]; do
+     case $in in
+       "$pfx"[0-9a-fA-F][0-9a-fA-F]*) in="${in#${pfx}}";;
+       \\*) in="${in#?}"; out="${out}\\\\"; continue;;
+        %*) in="${in#?}"; out="${out}%%";  continue;;
+         *) att="${in%%"${pfx}"*}"; att="${att%%%*}"; att="${att%%\\*}"
+            out="${out}${att}"; in="${in#"${att}"}"; continue;;
+     esac;
+ 
+     # Hex escapes for printf (e.g. \x41) are not portable 
+     # The portable way for Hex output is transforming Hex to Octal
+     # (e.g. \x41 = \101)
+     case $in in
+         [0123]?*) out="${out}\\0";;
+         [4567]?*) out="${out}\\1";;
+       [89aAbB]?*) out="${out}\\2";;
+       [c-fC-F]?*) out="${out}\\3";;
+     esac
+     case $in in
+             [048cC][0-7]*) out="${out}0";;
+        [048cC][89a-fA-F]*) out="${out}1";;
+             [159dD][0-7]*) out="${out}2";;
+        [159dD][89a-fA-F]*) out="${out}3";;
+            [26aAeE][0-7]*) out="${out}4";;
+       [26aAeE][89a-fA-F]*) out="${out}5";;
+            [37bBfF][0-7]*) out="${out}6";;
+       [37bBfF][89a-fA-F]*) out="${out}7";;
+     esac
+     case $in in
+        ?[08]*) out="${out}0";;
+        ?[19]*) out="${out}1";;
+       ?[2aA]*) out="${out}2";;
+       ?[3bB]*) out="${out}3";;
+       ?[4cC]*) out="${out}4";;
+       ?[5dD]*) out="${out}5";;
+       ?[6eE]*) out="${out}6";;
+       ?[7fF]*) out="${out}7";;
+     esac
+     in="${in#?}"
+     in="${in#?}"
+   done
+   printf -- "$out"
  }
  
  if [ -z "$REQUEST_METHOD" ]; then
@@@ -75,15 -144,17 +144,17 @@@
  
    (sleep $cgilite_timeout && kill $$) & cgilite_watchdog=$!
    while read REQUEST_METHOD REQUEST_URI SERVER_PROTOCOL; do
+     unset PATH_INFO QUERY_STRING cgilite_headers CONTENT_LENGTH CONTENT_TYPE
+ 
      [ "${SERVER_PROTOCOL#HTTP/1.[01]${CR}}" ] && break
      kill $cgilite_watchdog
  
      SERVER_PROTOCOL="${SERVER_PROTOCOL%${CR}}"
-     PATH_INFO="$(HEX_DECODE "${REQUEST_URI%\?*}" |PATH)"
+     PATH_INFO="$(HEX_DECODE % "${REQUEST_URI%\?*}" |PATH)"
      [ "${REQUEST_URI}" = "${REQUEST_URI#*\?}" ] \
      && QUERY_STRING='' \
      || QUERY_STRING="${REQUEST_URI#*\?}"
-     cgilite_headers=''; while read -r hl; do
+     while read -r hl; do
        hl="${hl%${CR}}"; [ "$hl" ] || break
        case $hl in
          'Content-Length: '*) CONTENT_LENGTH="${hl#*: }";;
@@@ -93,7 -164,7 +164,7 @@@
      done
  
      export REMOTE_ADDR SERVER_NAME SERVER_PORT REQUEST_METHOD REQUEST_URI SERVER_PROTOCOL \
-            PATH_INFO QUERY_STRING CONTENT_TYPE CONTENT_LENGTH
+            PATH_INFO QUERY_STRING CONTENT_TYPE CONTENT_LENGTH cgilite_headers
  
      # Try to serve multiple requests, provided that script serves a
      # Content-Length header.
@@@ -129,9 -200,13 +200,13 @@@ if [ "${REQUEST_METHOD}" = POST -a "${C
    cgilite_post="$(head -c "$CONTENT_LENGTH")"
  fi
  
+ PATH_INFO="$(PATH "/${PATH_INFO#${_BASE}}")"
+ 
  debug(){ [ $# -gt 0 ] && printf '%s\n' "$@" >&2 || tee -a /dev/stderr; }
  [ "${DEBUG+x}" ] && env >&2
  
+ # general helper functions, see GET, POST, and REF below
+ 
  cgilite_count(){
    printf %s "&$1" \
    | grep -oE '&'"$2"'=[^&]*' \
@@@ -145,7 -220,7 +220,7 @@@ cgilite_value()
      str="${str#*&${name}=}"
      cnt=$((cnt - 1))
    done
-   printf -- "$(printf %s "${str%%&*}" |sed -E 's;\+; ;g;'"$HEX_DECODE")"
+   HEX_DECODE % "$(printf %s "${str%%&*}" |tr + \  )"
  }
  
  cgilite_keys(){
@@@ -157,15 -232,26 +232,26 @@@
    | sort -u
  }
  
- GET(){ cgilite_value "${QUERY_STRING}" $@; }
+ # Read arguments from GET, POST, or the query string of the referrer (REF).
+ # Example:
+ # GET varname n
+ #
+ # where n is number for the Nth occurence of a variable and defaults to 1
+ #
+ # *_COUNT varname
+ # -> returns number of ocurences
+ # *_KEYS
+ # -> returns list of available varnames
+ 
+ GET(){ cgilite_value "${QUERY_STRING}" "$@"; }
  GET_COUNT(){ cgilite_count "${QUERY_STRING}" $1; }
  GET_KEYS(){ cgilite_keys "${QUERY_STRING}"; }
  
- POST(){ cgilite_value "${cgilite_post}" $@; }
+ POST(){ cgilite_value "${cgilite_post}" "$@"; }
  POST_COUNT(){ cgilite_count "${cgilite_post}" $1; }
  POST_KEYS(){ cgilite_keys "${cgilite_post}"; }
  
- REF(){ cgilite_value "${HTTP_REFERER#*\?}" $@; }
+ REF(){ cgilite_value "${HTTP_REFERER#*\?}" "$@"; }
  REF_COUNT(){ cgilite_count "${HTTP_REFERER#*\?}" $1; }
  REF_KEYS(){ cgilite_keys "${HTTP_REFERER#*\?}"; }
  
@@@ -178,14 -264,15 +264,15 @@@ HEADER()
      str="${str#*${BR}${1}: }"
      printf %s "${str%%${BR}*}"
    else
-     local var="HTTP_$(printf %s "$1" |tr a-z- A-Z-)"
+     local var="HTTP_$(printf %s "$1" |tr a-z- A-Z_)"
      eval "[ \"\$$var\" ] && printf %s \"\$$var\" || return 1"
      # eval "printf %s \"\$HTTP_$(printf %s "${1}" |tr a-z A-Z |tr -c A-Z _)\""
    fi
  }
  
  COOKIE(){
-   HEX_DECODE "$(
+   # Read value of cookie
+   HEX_DECODE % "$(
      HEADER Cookie \
      | grep -oE '(^|; ?)'"$1"'=[^;]*' \
      | sed -En "${2:-1}"'{s;^[^=]+=;;; s;\+; ;g; p;}'
@@@ -197,21 -284,18 +284,18 @@@ HTML()
    # Also escape [, ], and \n for use in html-sh
    local str out
    [ $# -eq 0 ] && str="$(cat)" || str="$*"
-   while [ "$str" ]; do
-     case $str in
-       \&*) out="${out}&amp;";;
-       \<*) out="${out}&lt;";;
-       \>*) out="${out}&gt;";;
-       \"*) out="${out}&quot;";;
-       \'*) out="${out}&#x27;";;
-       \[*) out="${out}&#x5B;";;
-       \]*) out="${out}&#x5D;";;
-       "${CR}"*) out="${out}&#x0D;";;
-       "${BR}"*) out="${out}&#x0A;";;
-       *) out="${out}${str%"${str#?}"}";;
-     esac
-     str="${str#?}"
-   done
+   while [ "$str" ]; do case $str in
+     \&*) out="${out}&amp;";       str="${str#?}";;
+     \<*) out="${out}&lt;";        str="${str#?}";;
+     \>*) out="${out}&gt;";        str="${str#?}";;
+     \"*) out="${out}&quot;";      str="${str#?}";;
+     \'*) out="${out}&#x27;";      str="${str#?}";;
+     \[*) out="${out}&#x5B;";      str="${str#?}";;
+     \]*) out="${out}&#x5D;";      str="${str#?}";;
+     "${CR}"*) out="${out}&#x0D;"; str="${str#?}";;
+     "${BR}"*) out="${out}&#x0A;"; str="${str#?}";;
+     *) out="${out}${str%%[]&<>\"\'${CR}${BR}[]*}"; str="${str#"${str%%[]&<>\"\'${CR}${BR}[]*}"}";;
+   esac; done
    printf %s "$out"
  }
  
@@@ -219,24 -303,21 +303,21 @@@ URL()
    # Escape pathes, so they can be used in link tags and HTTP Headers
    local str out
    [ $# -eq 0 ] && str="$(cat)" || str="$*"
-   while [ "$str" ]; do
-     case $str in
-       \&*) out="${out}%26";;
-       \"*) out="${out}%22";;
-       \'*) out="${out}%27";;
-       \?*) out="${out}%3F";;
-       \#*) out="${out}%23";;
-       \[*) out="${out}%5B";;
-       \]*) out="${out}%5D";;
-       \ *) out="${out}%20";;
-       "	"*) out="${out}%09";;
-       "${CR}"*) out="${out}%0D";;
-       "${BR}"*) out="${out}%0A";;
-       %*) out="${out}%25";;
-       *) out="${out}${str%"${str#?}"}";;
-     esac
-     str="${str#?}"
-   done
+   while [ "$str" ]; do case $str in
+     \&*) out="${out}%26"; str="${str#?}";;
+     \"*) out="${out}%22"; str="${str#?}";;
+     \'*) out="${out}%27"; str="${str#?}";;
+     \?*) out="${out}%3F"; str="${str#?}";;
+     \#*) out="${out}%23"; str="${str#?}";;
+     \[*) out="${out}%5B"; str="${str#?}";;
+     \]*) out="${out}%5D"; str="${str#?}";;
+     \ *) out="${out}%20"; str="${str#?}";;
+     "	"*) out="${out}%09"; str="${str#?}";;
+     "${CR}"*) out="${out}%0D"; str="${str#?}";;
+     "${BR}"*) out="${out}%0A"; str="${str#?}";;
+     %*) out="${out}%25"; str="${str#?}";;
+     *) out="${out}${str%%[]&\"\'\?# 	${CR}${BR}%[]*}"; str="${str#"${str%%[]&\"\'\?# 	${CR}${BR}%[]*}"}";;
+   esac; done
    printf %s "$out"
  }
  
@@@ -259,6 -340,7 +340,7 @@@ SET_COOKIE()
  }
  
  REDIRECT(){
+   # Trigger redirct and terminate script
    printf '%s: %s\r\n' \
      Status "303 See Other" \
      Content-Length 0 \
diff --combined cgilite/common.css
index f9b17ad,65c28f3..65c28f3
--- a/cgilite/common.css
+++ b/cgilite/common.css
@@@ -16,7 -16,14 +16,14 @@@ body 
    color: #000; background: #FFF;
  }
  
- ul, ol, dl, table, p { margin-bottom: .5em; }
+ ul, ol, dl, table, pre, p { margin-bottom: .5em; }
+ p:only-child { margin-bottom: 0; }
+ 
+ table {
+   max-width: 100%;
+   overflow-x: auto;
+ }
+ th, td { padding: .25em .75em; }
  
  a {
    font-style: italic;
@@@ -44,6 -51,12 +51,12 @@@ ul, ol { margin-left: 1.125em; 
  dl dt { font-weight: bolder; }
  table th { font-weight: bold; }
  
+ li p + ul, li p + ol {
+   margin-top: -.25em;
+ }
+ 
+ hr { border-bottom: 1pt solid; }
+ 
  h1, h2, h3 {
    font-weight: bold;
    margin-top: .75em;
@@@ -68,6 -81,7 +81,7 @@@ select, input, button, textarea, a.butt
    border-radius: 2pt;
  }
  select { padding: .375em 0; }
+ textarea { min-height: 7em; }
  
  input[type=radio], input[type=checkbox] {
    vertical-align: baseline;
@@@ -87,6 -101,21 +101,21 @@@ input + label 
    margin-left: .375em;
  }
  
+ input.search + button.search {
+   width: 2.5em;
+   color: transparent;
+   background-color: #CCC;
+   margin-left: -2pt;
+   border-left: none;
+   border-radius: 0 2pt 2pt 0;
+   white-space: nowrap;
+ }
+ input.search + button.search:before {
+   content: '\1f50d';
+   color: #000;
+   font-weight: bold;
+ }
+ 
  @media print {
    @page { margin: 20mm; }
  
@@@ -108,7 -137,8 +137,8 @@@
  *[tooltip]:hover:after {
    display: block;
    position: absolute;
-   bottom: -100%; left: 50%; transform: translate(-50%, 0);
+   min-width: 12em;
+   bottom: 100%; left: 50%; transform: translate(-50%, 0);
    content: attr(tooltip);
    padding: .5em;
    color: #000; background-color: #FFC;
diff --combined cgilite/file.sh
index 04a8ef6,0d1f4ea..0d1f4ea
--- a/cgilite/file.sh
+++ b/cgilite/file.sh
@@@ -22,24 -22,27 +22,27 @@@ include_fileserve="$0
  
  file_type(){
    case ${1##*.} in
-     html|html) printf 'text/html';;
      css)       printf 'text/css';;
-     js)        printf 'text/javascript';;
-     txt)       printf 'text/plain';;
-     sh)        printf 'text/shellscript';;
+     gif)       printf 'image/gif';;
+     html|html) printf 'text/html';;
      jpg|jpeg)  printf 'image/jpeg';;
+     js)        printf 'text/javascript';;
+     m3u8)      printf 'application/x-mpegURL';;
+     m4a)       printf 'audio/mp4';;
+     m4s)       printf 'video/iso.segment';;
+     m4v|mp4)   printf 'video/mp4';;
+     mpd)       printf 'application/dash+xml';;
+     ogg)       printf 'audio/ogg';;
+     pdf)       printf 'application/pdf';;
      png)       printf 'image/png';;
+     sh)        printf 'text/x-shellscript';;
      svg)       printf 'image/svg+xml';;
-     gif)       printf 'image/gif';;
+     tex)       printf 'text/x-tex';;
+     txt)       printf 'text/plain';;
+     short)     printf 'text/prs.shorthand';;
+     ts)        printf 'video/MP2T';;
      webm)      printf 'video/webm';;
-     mp4|m4v)   printf 'video/mp4';;
-     m4a)       printf 'audio/mp4';;
-     ogg)       printf 'audio/ogg';;
      xml)       printf 'application/xml';;
-     m3u8)      printf 'application/x-mpegURL';;
-     ts)        printf 'video/MP2T';;
-     mpd)       printf 'application/dash+xml';;
-     m4s)       printf 'video/iso.segment';;
      *)         printf 'application/octet-stream';;
    esac
  }
@@@ -58,8 -61,7 +61,7 @@@ FILE()
  
    file_size="$(stat -Lc %s "$file")"
    file_date="$(stat -Lc %Y "$file")"
-   http_date="$(date -uRd @$file_date)"
-   http_date="${http_date%+0000}GMT"
+   http_date="$(date -ud "@$file_date" +"%a, %d %b %Y %T GMT")"
    cachedate="$(
      # Parse the allowable date formats from Section 3.3.1 of
      # https://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html
diff --combined cgilite/markdown.awk
index 0000000,44d4e0d..44d4e0d
mode 000000,100755..100755
--- a/cgilite/markdown.awk
+++ b/cgilite/markdown.awk
@@@ -1,0 -1,627 +1,627 @@@
+ #!/bin/awk -f
+ #!/opt/busybox/awk -f
+ 
+ # EXPERIMENTAL Markdown processor with minimal dependencies.
+ # Meant to support all features of John Grubers basic Markdown
+ # + a number of common extensions, mostly inspired by Pandoc Markdown
+ 
+ # Supported Features / TODO:
+ # ==========================
+ # [x] done    [ ] todo    [-] not planned    ? unsure
+ #
+ # Basic Markdown - Block elements:
+ # -------------------------------
+ # - [x] Paragraphs
+ #   - [x] Double space line breaks
+ # - [x] Proper block element nesting
+ # - [x] Headings
+ # - [x] ATX-Style Headings
+ # - [x] Blockquotes
+ # - [x] Lists (ordered, unordered)
+ # - [x] Code blocks (using indention)
+ # - [x] Horizontal rules
+ # - [x] Verbatim HTML block (disabled by default)
+ #
+ # Basic Markdown - Inline elements:
+ # ---------------------------------
+ # - [x] Links
+ # - [x] Reference style links
+ # - [x] Emphasis *em*/**strong** (*Asterisk*, _Underscore_)
+ # - [x] `code`, also ``code containing `backticks` ``
+ # - [x] Images / reference style images
+ # - [x] <automatic links>
+ # - [x] backslash escapes
+ # - [x] Verbatim HTML inline (disabled by default)
+ # - [x] HTML escaping
+ #
+ # NOTE: Set the environment variable MD_HTML=true to enable verbatim HTML
+ #
+ # Extensions - Block elements:
+ # ----------------------------
+ # -  ?  Heading identifiers (php md, pandoc)
+ # - [x] Automatic heading identifiers (custom)
+ # - [x] Fenced code blocks (php md, pandoc)
+ #   - [x] Fenced code attributes
+ # - [/] Tables
+ #   -  ?  Simple table (pandoc)
+ #   -  ?  Multiline table (pandoc)
+ #   - [x] Grid table (pandoc)
+ #   - [x] Pipe table (php md pandoc)
+ # - [x] Line blocks (pandoc)
+ # - [x] Task lists (pandoc, custom)
+ # - [ ] Definition lists (php md, pandoc)
+ # - [-] Numbered example lists (pandoc)
+ # - [-] Metadata blocks (pandoc)
+ # - [x] Metadata blocks (custom)
+ # - [x] Fenced Divs (pandoc)
+ #
+ # Extensions - Inline elements:
+ # ----------------------------
+ # - [x] Ignore embedded_underscores (php md, pandoc)
+ # - [x] ~~strikeout~~ (pandoc)
+ # - [x] ^Superscript^ ~Subscript~ (pandoc)
+ # - [-] Bracketed spans (pandoc)
+ #   - [-] Inline attributes (pandoc)
+ # - [x] Image attributes (custom, pandoc inspired, inline only)
+ # - [x] Wiki style links [[PageName]] / [[PageName|Link Text]]
+ # - [-] TEX-Math (pandoc)
+ # -  ?  Footnotes (php md)
+ # -  ?  Abbreviations (php md)
+ # -  ?  "Curly quotes" (smartypants)
+ # - [ ] em-dashes (--) (smartypants old)
+ # -  ?  ... three-dot ellipsis (smartypants)
+ # - [-] en-dash (smartypants)
+ # - [ ] Automatic em-dash / en-dash
+ # - [ ] Automatic -> Arrows <-
+ 
+ function debug(text) { printf "\n---\n%s\n---\n", text > "/dev/stderr"; }
+ 
+ function HTML ( text ) {
+   gsub( /&/,  "\\&amp;",  text );
+   gsub( /</,  "\\&lt;",   text );
+   gsub( />/,  "\\&gt;",   text );
+   gsub( /"/,  "\\&quot;", text );
+   gsub( /'/,  "\\&#x27;", text );
+   gsub( /\\/, "\\&#x5C;", text );
+   return text;
+ }
+ 
+ function inline( line, LOCAL, len, code, href, guard ) {
+   nu = "(\\\\\\\\|\\\\[^\\\\]|[^\\\\_]|_[[:alnum:]])*"    # not underline (except when escaped)
+   na = "(\\\\\\\\|\\\\[^\\\\]|[^\\\\\\*])*"  # not asterisk (except when escaped)
+   ieu =  "_([^_[:space:]]|[^_[:space:]]" nu "[^_[:space:]])_"                 # inner <em> (underline)
+   isu = "__([^_[:space:]]|[^_[:space:]]" nu "[^_[:space:]])__"                # inner <strong> (underline)
+   iea =    "\\*([^\\*[:space:]]|[^\\*[:space:]]" na "[^\\*[:space:]])\\*"     # inner <em> (asterisk)
+   isa = "\\*\\*([^\\*[:space:]]|[^\\*[:space:]]" na "[^\\*[:space:]])\\*\\*"  # inner <strong> (asterisk)
+ 
+   if ( line ~ /^$/ ) {  # Recursion End
+     return "";
+ 
+   #  omit processing of escaped characters
+   } else if ( line ~ /^\\[]\\`\*_\{\}\(\)#\+-\.![]/) {
+     return substr(line, 2, 1) inline( substr(line, 3) );
+ 
+   # hard brakes
+   } else if ( match(line, /^  \n/) ) {
+     return "<br />\n" inline( substr(line, RLENGTH + 1) );
+ 
+   #  ``code spans``
+   } else if ( match( line, /^`+/) ) {
+     len = RLENGTH
+     guard = substr( line, 1, len )
+     if ( match(line, guard ".*" guard) ) {
+       code = substr( line, len + 1, match( substr(line, len + 1), guard ) - 1)
+       len = 2 * length(guard) + length(code)
+       #  strip single surrounding white spaces
+       code = gensub( / (.*) /, "\\1", "1" , code)
+       #  escape HTML within code span
+       gsub( /&/, "\\&amp;", code ); gsub( /</, "\\&lt;", code ); gsub( />/, "\\&gt;", code );
+       return "<code>" code "</code>" inline( substr( line, len + 1 ) )
+     }
+ 
+   # Wiki style links
+   } else if ( match( line, /^\[\[([^\]\|]+)(\|([^\]]+))?\]\]/) ) {
+     len = RLENGTH;
+     href = gensub(/^\[\[([^\]\|]+)(\|([^\]]+))?\]\]/, "\\1", 1, substr(line, 1, len) );
+     text = gensub(/^\[\[([^\]\|]+)(\|([^\]]+))?\]\]/, "\\3", 1, substr(line, 1, len) );
+     if ( ! text ) text = href;
+     return "<a href=\"" HTML(href) "\">" HTML(text) "</a>" inline( substr( line, len + 1) );
+ 
+   #  quick links ("automatic links" in md doc)
+   } else if ( match( line, /^<[a-zA-Z]+:\/\/([-\.[:alnum:]]+)(:[0-9]*)?(\/[^>]*)?>/ ) ) {
+     len = RLENGTH;
+     href = HTML( substr( line, 2, len - 2) );
+     return "<a href=\"" href "\">" href "</a>" inline( substr( line, len + 1) );
+ 
+   # quick link email
+   } else if ( match( line, /^<[a-zA-Z0-9.!#$%&'\''*+\/=?^_`{|}~-]+@[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*>/ ) ) {
+     len = RLENGTH;
+     href = HTML( substr( line, 2, len - 2) );
+     return "<a href=\"mailto:" href "\">" href "</a>" inline( substr( line, len + 1) );
+ 
+   # inline links
+   } else if ( match(line, /^\[([^]]+)\]\(([^"\)]+)([[:space:]]+"([^"]+)")?\)/) ) {
+     len = RLENGTH;
+     text  = gensub(/^\[([^]]+)\]\(([^"\)]+)([[:space:]]+"([^"]+)")?\)/, "\\1", 1, substr(line, 1, len) );
+     href  = gensub(/^\[([^]]+)\]\(([^"\)]+)([[:space:]]+"([^"]+)")?\)/, "\\2", 1, substr(line, 1, len) );
+     title = gensub(/^\[([^]]+)\]\(([^"\)]+)([[:space:]]+"([^"]+)")?\)/, "\\4", 1, substr(line, 1, len) );
+     if ( title ) {
+       return "<a href=\"" HTML(href) "\" title=\"" HTML(title) "\">" inline( text ) "</a>" inline( substr( line, len + 1) );
+     } else {
+       return "<a href=\"" HTML(href) "\">" inline( text ) "</a>" inline( substr( line, len + 1) );
+     }
+ 
+   # reference style links
+   } else if ( match(line, /^\[([^]]+)\] ?\[([^]]*)\]/ ) ) {
+     len = RLENGTH;
+     text = gensub(/^\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\1", 1, substr(line, 1, len) );
+       id = gensub(/^\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\2", 1, substr(line, 1, len) );
+     if ( ! id ) id = text;
+     if ( rl_href[id] && rl_title[id] ) {
+       return "<a href=\"" HTML(rl_href[id]) "\" title=\"" HTML(rl_title[id]) "\">" inline(text) "</a>" inline( substr( line, len + 1) );
+     } else if ( rl_href[id] ) {
+       return "<a href=\"" HTML(rl_href[id]) "\">" inline(text) "</a>" inline( substr( line, len + 1) );
+     } else {
+       return "" HTML(substr(line, 1, len)) inline( substr(line, len + 1) );
+     }
+ 
+   # inline images
+   } else if ( match(line, /^!\[([^]]+)\]\(([^"\)]+)([ \t]+"([^"]+)")?\)(\{([a-zA-Z \t-]*)\})?/) ) {
+     len = RLENGTH;
+     text   = gensub(/^!\[([^]]+)\]\(([^"\)]+)([ \t]+"([^"]+)")?\)(\{([a-zA-Z \t-]*)\})?/, "\\1", "g", substr(line, 1, len) );
+     href   = gensub(/^!\[([^]]+)\]\(([^"\)]+)([ \t]+"([^"]+)")?\)(\{([a-zA-Z \t-]*)\})?/, "\\2", "g", substr(line, 1, len) );
+     title  = gensub(/^!\[([^]]+)\]\(([^"\)]+)([ \t]+"([^"]+)")?\)(\{([a-zA-Z \t-]*)\})?/, "\\4", "g", substr(line, 1, len) );
+     attrib = gensub(/^!\[([^]]+)\]\(([^"\)]+)([ \t]+"([^"]+)")?\)(\{([a-zA-Z \t-]*)\})?/, "\\6", "g", substr(line, 1, len) );
+     if ( title && attrib ) {
+       return "<img src=\"" HTML(href) "\" alt=\"" HTML(text) "\" title=\"" HTML(title) "\" class=\"" HTML(attrib) "\"/>" inline( substr( line, len + 1) );
+     } else if ( title ) {
+       return "<img src=\"" HTML(href) "\" alt=\"" HTML(text) "\" title=\"" HTML(title) "\" />" inline( substr( line, len + 1) );
+     } else if ( attrib ) {
+       return "<img src=\"" HTML(href) "\" alt=\"" HTML(text) "\" class=\"" HTML(attrib) "\" />" inline( substr( line, len + 1) );
+     } else {
+       return "<img src=\"" HTML(href) "\" alt=\"" HTML(text) "\" />" inline( substr( line, len + 1) );
+     }
+ 
+   # reference style images
+   } else if ( match(line, /^!\[([^]]+)\] ?\[([^]]*)\]/ ) ) {
+     len = RLENGTH;
+     text = gensub(/^!\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\1", 1, substr(line, 1, len) );
+       id = gensub(/^!\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\2", 1, substr(line, 1, len) );
+     if ( ! id ) id = text;
+     if ( rl_href[id] && rl_title[id] ) {
+       return "<img src=\"" HTML(rl_href[id]) "\" alt=\"" HTML(text) "\" title=\"" HTML(rl_title[id]) "\" />" inline( substr( line, len + 1) );
+     } else if ( rl_href[id] ) {
+       return "<img src=\"" HTML(rl_href[id]) "\" alt=\"" HTML(text) "\" />" inline( substr( line, len + 1) );
+     } else {
+       return "" HTML(substr(line, 1, len)) inline( substr(line, len + 1) );
+     }
+ 
+   #  ~~strikeout~~ (pandoc)
+   } else if ( match(line, /^~~([[:graph:]]|[[:graph:]]([^~]|~[^~])*[[:graph:]])~~/) ) {
+     len = RLENGTH;
+     return "<del>" inline( substr( line, 3, len - 4 ) ) "</del>" inline( substr( line, len + 1 ) );
+ 
+   #  ^superscript^ (pandoc)
+   } else if ( match(line, /^\^([^[:space:]^]|\\[ ^])+\^/) ) {
+     len = RLENGTH;
+     return "<sup>" inline( substr( line, 2, len - 2 ) ) "</sup>" inline( substr( line, len + 1 ) );
+ 
+   #  ~subscript~ (pandoc)
+   } else if ( match(line, /^~([^[:space:]~]|\\[ ~])+~/) ) {
+     len = RLENGTH;
+     return "<sub>" inline( substr( line, 2, len - 2 ) ) "</sub>" inline( substr( line, len + 1 ) );
+ 
+   # ignore embedded underscores (pandoc, php md)
+   } else if ( match(line, "^[[:alnum:]](__|_)") ) {
+     return HTML(substr( line, 1, RLENGTH)) inline( substr(line, RLENGTH + 1) );
+ 
+   #  __strong__$
+   } else if ( match(line, "^__(([^_[:space:]]|" ieu ")|([^_[:space:]]|" ieu ")(" nu "|" ieu ")*([^_[:space:]]|" ieu "))__$") ) {
+     len = RLENGTH;
+     return "<strong>" inline( substr( line, 3, len - 4 ) ) "</strong>" inline( substr( line, len + 1 ) );
+ 
+   #  __strong__
+   } else if ( match(line, "^__(([^_[:space:]]|" ieu ")|([^_[:space:]]|" ieu ")(" nu "|" ieu ")*([^_[:space:]]|" ieu "))__[[:space:][:punct:]]") ) {
+     len = RLENGTH;
+     return "<strong>" inline( substr( line, 3, len - 5 ) ) "</strong>" inline( substr( line, len) );
+ 
+   #  **strong**
+   } else if ( match(line, "^\\*\\*(([^\\*[:space:]]|" iea ")|([^\\*[:space:]]|" iea ")(" na "|" iea ")*([^\\*[:space:]]|" iea "))\\*\\*") ) {
+     len = RLENGTH;
+     return "<strong>" inline( substr( line, 3, len - 4 ) ) "</strong>" inline( substr( line, len + 1 ) );
+ 
+   #  _em_$
+   } else if ( match(line, "^_(([^_[:space:]]|" isu ")|([^_[:space:]]|" isu ")(" nu "|" isu ")*([^_[:space:]]|" isu "))_$") ) {
+     len = RLENGTH;
+     return "<em>" inline( substr( line, 2, len - 2 ) ) "</em>" inline( substr( line, len + 1 ) );
+ 
+   #  _em_
+   } else if ( match(line, "^_(([^_[:space:]]|" isu ")|([^_[:space:]]|" isu ")(" nu "|" isu ")*([^_[:space:]]|" isu "))_[[:space:][:punct:]]") ) {
+     len = RLENGTH;
+     return "<em>" inline( substr( line, 2, len - 3 ) ) "</em>" inline( substr( line, len ) );
+ 
+   #  *em*
+   } else if ( match(line, "^\\*(([^\\*[:space:]]|" isa ")|([^\\*[:space:]]|" isa ")(" na "|" isa ")*([^\\*[:space:]]|" isa "))\\*") ) {
+     len = RLENGTH;
+     return "<em>" inline( substr( line, 2, len - 2 ) ) "</em>" inline( substr( line, len + 1 ) );
+ 
+   # Macros
+   } else if ( AllowMacros && match( line, /^<<([^>]|>[^>])+>>/) ) {
+     len = RLENGTH;
+     return macro( substr( line, 3, len - 4 ) ) inline(substr(line, len + 1));
+ 
+   # Verbatim inline HTML
+   } else if ( AllowHTML && match( line, /^(<!--([^-]|-[^-]|--[^>])*-->|<\?([^\?]|\?[^>])*\?>|<![A-Z][^>]*>|<!\[CDATA\[([^\]]|\][^\]]|\]\][^>])*\]\]>|<\/[A-Za-z][A-Za-z0-9-]*[[:space:]]*>|<[A-Za-z][A-Za-z0-9-]*([[:space:]]+[A-Za-z_:][A-Za-z0-9_\.:-]*([[:space:]]*=[[:space:]]*([[:space:]"'=<>`]+|"[^"]*"|'[^']*'))?)*[[:space:]]*\/?>)/) ) {
+     len = RLENGTH;
+     return substr( line, 1, len) inline(substr(line, len + 1));
+ 
+   # Literal HTML entities
+   } else if ( match( line, /^&([a-zA-Z]{2,32}|#[0-9]{1,7}|#[xX][0-9a-fA-F]{1,6});/) ) {
+     len = RLENGTH;
+     return substr( line, 1, len ) inline(substr(line, len + 1));
+ 
+   # Escape lone HTML character
+   } else if ( match( line, /^[&<>"']/) ) {
+     return HTML(substr(line, 1, 1)) inline(substr(line, 2));
+ 
+   #  continue walk over string
+   } else {
+     return substr(line, 1, 1) inline( substr(line, 2) );
+   }
+ }
+ 
+ function _block( block, LOCAL, st, len, hlvl, htxt, guard, code, indent, attrib ) {
+   gsub( /^\n+|\n+$/, "", block );
+ 
+   if ( block == "" ) {
+     return "";
+ 
+   # HTML #2 #3 #4 $5
+   } else if ( AllowHTML && match( block, /(^|\n) ? ? ?(<!--([^-]|-[^-]|--[^>])*(-->|$)|<\?([^\?]|\?[^>])*(\?>|$)|<![A-Z][^>]*(>|$)|<!\[CDATA\[([^\]]|\][^\]]|\]\][^>])*(\]\]>|$))/) ) {
+     len = RLENGTH; st = RSTART;
+     return _block(substr(block, 1, st - 1)) substr(block, st, len) _block(substr(block, st + len));
+ 
+   # HTML #6
+   } else if ( AllowHTML && match( tolower(block), /(^|\n) ? ? ?<\/?(address|article|aside|base|basefont|blockquote|body|caption|center|col|colgroup|dd|details|dialog|dir|div|dl|dt|fieldset|figcaption|figure|footer|form|frame|frameset|h[123456]|head|header|hr|html|iframe|legend|li|link|main|menu|menuitem|nav|noframes|ol|optgroup|option|p|param|section|source|summary|table|tbody|td|tfoot|th|thead|title|tr|track|ul)([[:space:]\n>]|\/>)([^\n]|\n[ \t]*[^\n])*(\n[[:space:]]*\n|$)/) ) {
+     len = RLENGTH; st = RSTART;
+     return _block(substr(block, 1, st - 1)) substr(block, st, len) _block(substr(block, st + len));
+ 
+   # HTML #1
+   } else if ( AllowHTML && match( tolower(block), /(^|\n) ? ? ?<(script|pre|style)([[:space:]\n>]).*(<\/script>|<\/pre>|<\/style>|$)/) ) {
+     len = RLENGTH; st = RSTART;
+     match( tolower(substr(block, st, len)), /(<\/script>|<\/pre>|<\/style>)/);
+     len = RSTART + RLENGTH;
+     return _block(substr(block, 1, st - 1)) substr(block, st, len) _block(substr(block, st + len));
+ 
+   # HTML #7
+   } else if ( AllowHTML && match( block, /^ ? ? ?(<\/[A-Za-z][A-Za-z0-9-]*[[:space:]]*>|<[A-Za-z][A-Za-z0-9-]*([[:space:]]+[A-Za-z_:][A-Za-z0-9_\.:-]*([[:space:]]*=[[:space:]]*([[:space:]"'=<>`]+|"[^"]*"|'[^']*'))?)*[[:space:]]*\/?>)([[:space:]]*\n)([^\n]|\n[ \t]*[^\n])*(\n[[:space:]]*\n|$)/) ) {
+     len = RLENGTH; st = RSTART;
+     return substr(block, st, len) _block(substr(block, st + len));
+ 
+   # Metadata (custom, block starting with %something)
+   # Metadata is ignored but can be interpreted externally
+   } else if ( match(block, /^%[a-zA-Z]+([[:space:]][^\n]*)?(\n|$)(%[a-zA-Z]+([[:space:]][^\n]*)?(\n|$)|%([[:space:]][^\n]*)?(\n|$)|[ \t]+[^\n[:space:]][^\n]*(\n|$))*/) ) {
+     len = RLENGTH; st = RSTART;
+     return  _block( substr( block, len + 1) );
+  
+   # Blockquote (leading >)
+   } else if ( match( block, /^> /) ) {
+     match( block, /(^|\n)[[:space:]]*(\n|$)/ ) || match(block, /$/);
+     len = RLENGTH; st = RSTART;
+     return "<blockquote>\n" _block( gensub( /(^|\n)> /, "\n", "g", substr(block, 1, st - 1) ) ) "</blockquote>\n\n" \
+            _block( substr(block, st + len) );
+ 
+   # Pipe Tables (pandoc / php md / gfm )
+   } else if ( match(block, "^((\\|)?([^\n]+\\|)+[^\n]+(\\|)?)\n" \
+                            "((\\|)?:?(-+:?[\\|+])+:?-+:?(\\|)?)\n" \
+                            "((\\|)?([^\n]+\\|)+[^\n]+(\\|)?(\n|$))+" ) ) {
+     len = RLENGTH; st = RSTART;
+     #initialize empty arrays
+     split("", talign); split("", tarray);
+     cols = 0; cnt=0; ttext = "";
+ 
+     # table header and alignment
+     split( gensub( /(^\||\|$)/, "", "g", \
+            gensub( /(^|[^\\])\\\|/, "\\1\\&#x7C;", "g", \
+            substr(block, 1, match(block, /(\n|$)/)) \
+     )), tarray, /\|/);
+     block = substr(block, match(block, /(\n|$)/) + 1 );
+     cols = split( \
+            gensub( /(^\||\|$)/, "", "g", \
+            substr(block, 1, match(block, /(\n|$)/)) \
+     ), talign, /[+\|]/);
+     block = substr(block, match(block, /(\n|$)/) + 1 );
+ 
+     for( cnt = 1; cnt < cols; cnt++ ) {
+            if (match(talign[cnt], /:-+:/)) talign[cnt]="center";
+       else if (match(talign[cnt],  /-+:/)) talign[cnt]="right";
+       else if (match(talign[cnt],  /:-+/)) talign[cnt]="left";
+       else talign[cnt]="";
+     }
+ 
+     ttext = "<thead>\n<tr>"
+     for (cnt = 1; cnt < cols; cnt++)
+       ttext = ttext "<th align=\"" talign[cnt] "\">" inline(tarray[cnt]) "</th>"
+     ttext = ttext "</tr>\n</thead><tbody>\n"
+ 
+     while ( match(block, "^((\\|)?([^\n]+\\|)+[^\n]+(\\|)?(\n|$))+" ) ){
+       split( gensub( /(^\||\|$)/, "", "g", \
+              gensub( /(^|[^\\])\\\|/, "\\1\\&#x7C;", "g", \
+              substr(block, 1, match(block, /(\n|$)/)) \
+       )), tarray, /\|/);
+       block = substr(block, match(block, /(\n|$)/) + 1 );
+ 
+       ttext = ttext "<tr>"
+       for (cnt = 1; cnt < cols; cnt++)
+         ttext = ttext "<td align=\"" talign[cnt] "\">" inline(tarray[cnt]) "</td>"
+       ttext = ttext "</tr>\n"
+     }
+     return "<table>" ttext "</tbody></table>\n" _block(block);
+ 
+   # Grid Tables (pandoc)
+   } else if ( match(block, "^\\+(-+\\+)+\n" \
+                        "(\\|([^\n]+\\|)+\n)+" \
+                         "\\+(:?=+:?\\+)+\n" \
+                       "((\\|([^\n]+\\|)+\n)+" \
+                             "\\+(-+\\+)+(\n|$))+" \
+             ) ) {
+     len = RLENGTH; st = RSTART;
+     #initialize empty arrays
+     split("", talign); split("", tarray); split("", tread);
+     cols = 0; cnt=0; ttext = "";
+ 
+     # table header and alignment
+     block = substr(block, match(block, /(\n|$)/) + 1 );
+     while ( match(block, "^\\|([^\n]+\\|)+\n") ) {
+       cols = split( gensub( /(^\||\|$)/, "", "g", \
+              gensub( /(^|[^\\])\\\|/, "\\1\\&#x7C;", "g", \
+              substr(block, 1, match(block, /(\n|$)/)) \
+       )), tread, /\|/);
+       block = substr(block, match(block, /(\n|$)/) + 1 );
+       for (cnt = 1; cnt < cols; cnt++)
+         tarray[cnt] = tarray[cnt] "\n" tread[cnt];
+     }
+ 
+     cols = split( \
+            gensub( /(^\+|\+$)/, "", "g", \
+            substr(block, 1, match(block, /(\n|$)/)) \
+     ), talign, /\+/);
+     block = substr(block, match(block, /(\n|$)/) + 1 );
+ 
+     for (cnt = 1; cnt < cols; cnt++) {
+            if (match(talign[cnt], /:=+:/)) talign[cnt]="center";
+       else if (match(talign[cnt],  /=+:/)) talign[cnt]="right";
+       else if (match(talign[cnt], /:=+/ )) talign[cnt]="left";
+       else talign[cnt]="";
+     }
+ 
+     ttext = "<thead>\n<tr>"
+     for (cnt = 1; cnt < cols; cnt++)
+       ttext = ttext "<th align=\"" talign[cnt] "\">" _block(tarray[cnt]) "</th>"
+     ttext = ttext "</tr>\n</thead><tbody>\n"
+ 
+     while ( match(block, /^((\|([^\n]+\|)+\n)+\+(-+\+)+(\n|$))+/ ) ){
+       split("", tarray);
+       while ( match(block, /^\|([^\n]+\|)+\n/) ) {
+         split( gensub( /(^\||\|$)/, "", "g", \
+                gensub( /(^|[^\\])\\\|/, "\\1\\&#x7C;", "g", \
+                substr(block, 1, match(block, /(\n|$)/)) \
+         )), tread, /\|/);
+         block = substr(block, match(block, /(\n|$)/) + 1 );
+         for (cnt = 1; cnt < cols; cnt++)
+           tarray[cnt] = tarray[cnt] "\n" tread[cnt];
+       }
+       block = substr(block, match(block, /(\n|$)/) + 1 );
+ 
+       ttext = ttext "<tr>"
+       for (cnt = 1; cnt < cols; cnt++)
+         ttext = ttext "<td align=\"" talign[cnt] "\">" _block(tarray[cnt]) "</td>"
+       ttext = ttext "</tr>\n"
+     }
+     return "<table>" ttext "</tbody></table>\n" _block(block);
+ 
+   # Line Blocks (pandoc)
+   } else if ( match(block, /^\| [^\n]*(\n|$)(\| [^\n]*(\n|$)|[ \t]+[^\n[:space:]][^\n]*(\n|$))*/) ) {
+     len = RLENGTH; st = RSTART;
+     code = substr(block, 1, len);
+     gsub(/\n[[:space:]]+/, " ", code);
+     gsub(/\n\| /, "\n", code);
+     gsub(/^\| |\n$/, "", code);
+     return "<div class=\"line-block\">" gensub(/\n/, "<br />\n", "g", inline( code )) "</div>\n" \
+            _block( substr( block, len + 1) );
+ 
+   # Indented Code Block
+   } else if ( match(block, /^(    |\t)( *\t*[^ \t\n]+ *\t*)+(\n|$)((    |\t)[^\n]+(\n|$)|[ \t]*(\n|$))*/) ) {
+     len = RLENGTH; st = RSTART;
+     code = substr(block, 1, len);
+     gsub(/(^|\n)(    |\t)/, "\n", code);
+     gsub(/^\n|\n+$/, "", code);
+     return "<pre><code>" HTML( code ) "</code></pre>\n" \
+            _block( substr( block, len + 1 ) );
+ 
+   # Fenced Divs (pandoc, custom)
+   } else if ( match( block, /^(:::+)/ ) ) {
+     guard = substr( block, 1, RLENGTH );
+     code = gensub(/^[^\n]+\n/, "", 1, block);
+     attrib = gensub(/^:::+[ \t]*\{?[ \t]*([^\}\n]*)\}?[ \t]*\n.*$/, "\\1", 1, block);
+     gsub(/[^a-zA-Z0-9_-]+/, " ", attrib);
+     gsub(/(^ | $)/, "", attrib);
+     if ( match(code, "(^|\n)" guard "+(\n|$)" ) ) {
+       len = RLENGTH; st = RSTART;
+       return "<div class=\"" attrib "\">" _block( substr(code, 1, st - 1) ) "</div>\n" \
+              _block( substr( code, st + len ) );
+     } else {
+       match( block, /(^|\n)[[:space:]]*(\n|$)/ ) || match( block, /$/ );
+       len = RLENGTH; st = RSTART;
+       return "<p>" inline( substr(block, 1, st - 1) ) "</p>\n" \
+              _block( substr(block, st + len) );
+     }
+ 
+   # Fenced Code Block (pandoc)
+   } else if ( match( block, /^(~~~+|```+)/ ) ) {
+     guard = substr( block, 1, RLENGTH );
+     code = gensub(/^[^\n]+\n/, "", 1, block);
+     attrib = gensub(/^(~~~+|```+)[ \t]*\{?[ \t]*([^\}\n]*)\}?[ \t]*\n.*$/, "\\2", 1, block);
+     gsub(/[^a-zA-Z0-9_-]+/, " ", attrib);
+     gsub(/(^ | $)/, "", attrib);
+     if ( match(code, "(^|\n)" guard "+(\n|$)" ) ) {
+       len = RLENGTH; st = RSTART;
+       return "<pre><code class=\"" attrib "\">" HTML( substr(code, 1, st - 1) ) "</code></pre>\n" \
+              _block( substr( code, st + len ) );
+     } else {
+       match( block, /(^|\n)[[:space:]]*(\n|$)/ ) || match( block, /$/ );
+       len = RLENGTH; st = RSTART;
+       return "<p>" inline( substr(block, 1, st - 1) ) "</p>\n" \
+              _block( substr(block, st + len) );
+     }
+ 
+   # Unordered list
+   } else if ( match( block, "^ ? ? ?[-+*][ \t]+[^\n]+(\n|$)" \
+                             "(([ \t]*\n)* ? ? ?[-+*][ \t]+[^\n]+(\n|$)" \
+                             "|([ \t]*\n)*( ? ? ?\t|  +)[^\n]+(\n|$)" \
+                             "|[^\n]+(\n|$))*" ) ) {
+   list = substr( block, 1, RLENGTH);
+   block = substr( block, RLENGTH + 1);
+   indent = length( gensub(/[-+*][ \t]+[^\n]+.*$/, "", 1, list) );
+ 
+   gsub("(^|\n) {0," indent "}", "\n", list);
+   return "\n<ul>\n" _list( substr(list, 2) ) "</ul>\n" _block( block );
+ 
+   # Ordered list
+   } else if ( match( block, "^ ? ? ?([0-9]+|#)\\.[ \t]+[^\n]+(\n|$)" \
+                             "(([ \t]*\n)* ? ? ?([0-9]+|#)\\.[ \t]+[^\n]+(\n|$)" \
+                             "|([ \t]*\n)*( ? ? ?\t|  +)[^\n]+(\n|$)" \
+                             "|[^\n]+(\n|$))*" ) ) {
+   list = substr( block, 1, RLENGTH);
+   block = substr( block, RLENGTH + 1);
+   indent = length( gensub(/([0-9]+|#)\.[ \t]+[^\n]+.*$/, "", 1, list) );
+ 
+   gsub("(^|\n) {0," indent "}", "\n", list);
+   return "\n<ol>\n" _list( substr(list, 2) ) "</ol>\n" _block( block );
+ 
+   # First Order Heading
+   } else if ( match( block, /^[^\n]+\n===+(\n|$)/ ) ) {
+     len = RLENGTH;
+     HL[1]++; HL[2] = 0; HL[3] = 0; HL[4] = 0; HL[5] = 0; HL[6] = 0;
+     return "<h1 id=\"" HL[1] " - " HTML(gensub( /\n.*$/, "", "g", block )) "\">" \
+            inline( gensub( /\n.*$/, "", "g", block ) ) \
+            "<a class=\"anchor\" href=\"#" HL[1] " - " \
+            HTML(gensub( /\n.*$/, "", "g", block )) "\"></a></h1>\n\n" \
+            _block( substr( block, len + 1 ) );
+ 
+   # Second Order Heading
+   } else if ( match( block, /^[^\n]+\n---+(\n|$)/ ) ) {
+     len = RLENGTH;
+     HL[2]++; HL[3] = 0; HL[4] = 0; HL[5] = 0; HL[6] = 0;
+     return "<h2 id=\"" HL[1] "." HL[2] " - " HTML(gensub( /\n.*$/, "", "g", block )) "\">" \
+            inline( gensub( /\n.*$/, "", "g", block ) ) \
+            "<a class=\"anchor\" href=\"#" HL[1] "." HL[2] " - " \
+            HTML(gensub( /\n.*$/, "", "g", block )) "\"></a></h2>\n\n" \
+            _block( substr( block, len + 1) );
+ 
+   # Nth Order Heading
+   } else if ( match( block, /^#{1,6}[ \t]*[^\n]+([ \t]*#*)(\n|$)/ ) ) {
+     len = RLENGTH;
+     hlvl = length( gensub( /^(#{1,6}).*$/, "\\1", "g", block ) );
+     htxt = gensub(/^#{1,6}[ \t]*(([^ \t\n]+|[ \t]+[^ \t\n#]|[ \t]+#+[^\n#])+)([ \t]*#*)(\n.*)?$/, "\\1", 1, block);
+     HL[hlvl]++; for ( n = hlvl + 1; n < 7; n++) { HL[n] = 0;}
+     hid = HL[1]; for ( n = 2; n <= hlvl; n++) { hid = hid "." HL[n] ; }
+     return "<h" hlvl " id=\"" hid " - " HTML(htxt) "\">" inline( htxt ) \
+            "<a class=\"anchor\" href=\"#" hid "\"></a></h" hlvl ">\n\n" \
+            _block( substr( block, len + 1) );
+ 
+   # Split paragraphs
+   } else if ( match( block, /(^|\n)[[:space:]]*(\n|$)/) ) {
+     len = RLENGTH; st = RSTART;
+     return _block( substr(block, 1, st - 1) ) "\n" \
+            _block( substr(block, st + len) );
+ 
+   # Horizontal rule
+   } else if ( match( block, /(^|\n) ? ? ?((\* *){3,}|(- *){3,}|(_ *){3,})($|\n)/) ) {
+     len = RLENGTH; st = RSTART;
+     return _block(substr(block, 1, st - 1)) "<hr />\n" _block(substr(block, st + len));
+ 
+   # Plain paragraph
+   } else {
+     return "<p>" inline(block) "</p>\n";
+   }
+ }
+ 
+ function _list( block, last, LOCAL, p) {
+   if ( ! length(block) ) return "";
+   gsub(/^([-+*]|[0-9]+\.|#\.)(  ? ? ?|\t)/, "", block)
+ 
+   # slice next list item from input
+   if ( match( block, /\n([-+*]|[0-9]+\.|#\.)[ \t]+[^\n]+/) ) {
+     p = substr( block, 1, RSTART);
+     block = substr( block, RSTART + 1);
+   } else {
+     p = block; block = "";
+   }
+   sub( /\n +([-+*]|[0-9]+\.|#\.)/, "\n&", p );
+ 
+   # if this should be a paragraph item
+   # either previous item (last) or current item (p) contains blank lines
+   if (match(last, /\n[[:space:]]*\n/) || match(p, /\n[[:space:]]*\n/) ) {
+     last = p; p = _block(p);
+   } else {
+     last = p; p = _block(p);
+     sub( /^<p>/, "", p );
+     sub( /<\/p>\n/, "", p );
+   }
+   sub( /\n$/, "", p );
+ 
+   # Task List (pandoc, custom)
+          if ( p ~ /^\[ \].*/ )       { return "<li class=\"task pending\"><input type=checkbox disabled />" \
+                                               substr(p, 4) "</li>\n" _list( block, last );
+   } else if ( p ~ /^\[-\].*/ )       { return "<li class=\"task negative\"><input type=checkbox disabled />" \
+                                               substr(p, 4) "</li>\n" _list( block, last );
+   } else if ( p ~ /^\[\?\].*/ )      { return "<li class=\"task unsure\"><input type=checkbox disabled />" \
+                                               substr(p, 4) "</li>\n" _list( block, last );
+   } else if ( p ~ /^\[\/\].*/ )      { return "<li class=\"task partial\"><input type=checkbox disabled />" \
+                                               substr(p, 4) "</li>\n" _list( block, last );
+   } else if ( p ~ /^\[[xX]\].*/ )    { return "<li class=\"task done\"><input type=checkbox disabled checked />" \
+                                             substr(p, 4) "</li>\n" _list( block, last );
+   } else if ( p ~ /^<p>\[ \].*/ )    { return "<li class=\"task pending\"><p><input type=checkbox disabled />" \
+                                               substr(p, 7) "</li>\n" _list( block, last );
+   } else if ( p ~ /^<p>\[-\].*/ )    { return "<li class=\"task negative\"><p><input type=checkbox disabled />" \
+                                               substr(p, 7) "</li>\n" _list( block, last );
+   } else if ( p ~ /^<p>\[\?\].*/ )   { return "<li class=\"task unsure\"><p><input type=checkbox disabled />" \
+                                               substr(p, 7) "</li>\n" _list( block, last );
+   } else if ( p ~ /^<p>\[\/\].*/ )   { return "<li class=\"task partial\"><p><input type=checkbox disabled />" \
+                                               substr(p, 7) "</li>\n" _list( block, last );
+   } else if ( p ~ /^<p>\[[xX]\].*/ ) { return "<li class=\"task done\"><p><input type=checkbox disabled checked />" \
+                                               substr(p, 7) "</li>\n" _list( block, last );
+   } else { return "<li>" p "</li>\n" _list( block, last ); }
+ }
+ 
+ BEGIN {
+   # Global Vars
+   file = ""; rl_href[""] = ""; rl_title[""] = "";
+   if (ENVIRON["MD_HTML"] == "true") { AllowHTML = "true"; }
+   HL[1] = 0; HL[2] = 0; HL[3] = 0; HL[4] = 0; HL[5] = 0; HL[6] = 0;
+ 
+   # Buffering of full file ist necessary, e.g. to find reference links
+   while (getline) { file = file $0 "\n"; }
+   # Clean up MS-DOS line breaks
+   gsub(/\r\n/, "\n", file);
+ 
+   # Fill array of reference links
+   f = file; rl_id;
+   re_reflink = "(^|\n) ? ? ?\\[([^]\n]+)\\]: ([^ \t\n]+)(\n?[ \t]+(\"([^\"]+)\"|'([^']+)'|\\(([^)]+)\\)))?(\n|$)";
+   # /(^|\n) ? ? ?\[([^]\n]+)\]: ([^ \t\n]+)(\n?[ \t]+("([^"]+)"|'([^']+)'|\(([^)]+)\)))?(\n|$)/
+   while ( match(f, re_reflink ) ) {
+     rl_id           = gensub( re_reflink, "\\2", 1, substr(f, RSTART, RLENGTH) );
+     rl_href[rl_id]  = gensub( re_reflink, "\\3", 1, substr(f, RSTART, RLENGTH) );
+     rl_title[rl_id] = gensub( re_reflink, "\\5", 1, substr(f, RSTART, RLENGTH) );
+     f = substr(f, RSTART + RLENGTH);
+     rl_title[rl_id] = substr( rl_title[rl_id], 2, length(rl_title[rl_id]) - 2 );
+     if ( rl_href[rl_id] ~ /<.*>/ ) rl_href[rl_id] = substr( rl_href[rl_id], 2, length(rl_href[rl_id]) - 2 );
+   }
+   # Clear reflinks from File
+   while( gsub(re_reflink, "\n", file ) );
+   # for (n in rl_href) { debug(n " | " rl_href[n] " | " rl_title[n] ); }
+ 
+   # Run Block Processing -> The Actual Markdown!
+   printf "%s", _block( file );
+ }
diff --combined cgilite/session.sh
index b9cef4d,1f4699e..1f4699e
--- a/cgilite/session.sh
+++ b/cgilite/session.sh
@@@ -3,6 -3,9 +3,9 @@@
  [ -n "$include_session" ] && return 0
  include_session="$0"
  
+ _DATE="$(date +%s)"
+ SESSION_TIMEOUT="${SESSION_TIMEOUT:-7200}"
+ 
  if ! which uuencode >/dev/null; then
    uuencode() { busybox uuencode "$@"; }
  fi
@@@ -10,8 -13,20 +13,20 @@@ if ! which sha256sum >/dev/null; the
    sha256sum() { busybox sha256sum "$@"; }
  fi
  
- _DATE="$(date +%s)"
- SESSION_TIMEOUT="${SESSION_TIMEOUT:-7200}"
+ if which openssl >/dev/null; then
+   session_mac(){ { [ $# -gt 0 ] && printf %s "$*" || cat; } | openssl dgst -sha1 -hmac "$(server_key)" -binary |slopecode; }
+ else
+   # Gonzo MAC if openssl is unavailable
+   session_mac(){
+     { server_key | dd status=none bs=256 count=1 skip=1
+       { server_key | dd status=none bs=256 count=1
+         [ $# -gt 0 ] && printf %s "$*" || cat
+       } \
+       | sha256sum -;
+     } \
+     | sha256sum | cut -d\  -f1
+   }
+ fi
  
  server_key(){
    IDFILE="${IDFILE:-${_DATA:-.}/serverkey}"
@@@ -25,23 -40,13 +40,13 @@@ slopecode()
    # 6-Bit Code that retains sort order of input data, while beeing safe to use
    # in ascii transmissions, unix file names, HTTP URLs, and HTML attributes
  
-   uuencode -m - | sed '
+   { [ $# -gt 0 ] && printf %s "$*" || cat; } \
+   | uuencode -m - | sed '
      1d;$d; 
      y;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/;0123456789:=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz;
    '
  }
  
- session_mac(){
-   local info
-   [ $# -eq 0 ] && info="$(cat)" || info="$*"
- 
-   if which openssl >/dev/null; then
-     printf %s "$info" |openssl dgst -sha1 -hmac "$(server_key)" -binary |slopecode
-   else
-     { printf %s "$info"; server_key; } |sha256sum |cut -d\  -f1
-   fi
- }
- 
  randomid(){
    dd bs=12 count=1 if=/dev/urandom 2>&- \
    | slopecode
@@@ -60,16 -65,17 +65,17 @@@ timeid()
    } | slopecode
  }
  
- checkid(){ grep -m 1 -xE '[0-9a-zA-Z:=]{16}'; }
- 
  transid(){
    # transaction ID to modify a given file
    local file="$1"
    session_mac "$(stat -c %F%i%n%N%s%Y "$file" 2>&-)" "$SESSION_ID"
  }
  
+ checkid(){ { [ $# -gt 0 ] && printf %s "$*" || cat; } | grep -m 1 -xE '[0-9a-zA-Z:=]{16}'; }
+ 
  update_session(){
    local session sid time sig checksig
+   unset SESSION_KEY SESSION_ID
  
    read -r sid time sig <<-END
  	$(POST session_key || COOKIE session)
@@@ -77,31 -83,44 +83,44 @@@
    
    checksig="$(session_mac "$sid" "$time")"
    
-   if ! [ "$checksig" = "$sig" \
-     -a "$time" -ge "$_DATE" \
-     -a "$(printf %s "$sid" |checkid)" ] 2>&-
+   if [ "$checksig" = "$sig" \
+        -a "$time" -ge "$_DATE" \
+        -a "$(checkid "$sid")" ] 2>&-
    then
-     debug "Setting up new session"
-     sid="$(randomid)"
+     time=$(( $_DATE + $SESSION_TIMEOUT ))
+     sig="$(session_mac "$sid" "$time")"
+ 
+     SESSION_KEY="${sid} ${time} ${sig}"
+     SESSION_ID="${sid}"
+     return 0
+   else
+     return 1
    fi
  
+ }
+ 
+ new_session(){
+   local sid time sig
+ 
+   debug "Setting up new session"
+   sid="$(randomid)"
    time=$(( $_DATE + $SESSION_TIMEOUT ))
    sig="$(session_mac "$sid" "$time")"
-   printf %s\\n "${sid} ${time} ${sig}"
- }
  
- SESSION_KEY="$(update_session)"
- SET_COOKIE 0 session="$SESSION_KEY" Path=/ SameSite=Strict HttpOnly
- SESSION_ID="${SESSION_KEY%% *}"
+   SESSION_KEY="${sid} ${time} ${sig}"
+   SESSION_ID="${sid}"
+ }
  
  SESSION_BIND() {
+   # Set tamper-proof authenticated cookie
    local key="$1" value="$2"
-   SET_COOKIE session "$key"="${value} $(session_mac "$value" "$SESSION_ID")"
+   SET_COOKIE session "$key"="${value} $(session_mac "$value" "$SESSION_ID")" Path="/${_BASE#/}" SameSite=Strict HttpOnly
  }
  
  SESSION_VAR() {
-   local key="$1"
-   local value sig
+   # read authenticated cookie
+   # fail if value has been tampered with
+   local key="$1" value sig
    value="$(COOKIE "$key")"
    sig="${value##* }" value="${value% *}"
    if [ "$sig" = "$(session_mac "$value" "$SESSION_ID")" ]; then
@@@ -110,3 -129,10 +129,10 @@@
      return 1
    fi
  }
+ 
+ SESSION_COOKIE() {
+   [ "$1" = new ] && new_session
+   SET_COOKIE 0 session="$SESSION_KEY" Path="/${_BASE#/}" SameSite=Strict HttpOnly
+ }
+ 
+ update_session || new_session
diff --combined cgilite/storage.sh
index 355bd56,22e6acc..22e6acc
--- a/cgilite/storage.sh
+++ b/cgilite/storage.sh
@@@ -1,6 -1,6 +1,6 @@@
  #!/bin/sh
  
- # Copyright 2018, 2019 Paul Hänsch
+ # Copyright 2018, 2019, 2021 Paul Hänsch
  #
  # This is a file format helper, part of CGIlite.
  # 
@@@ -25,41 -25,40 +25,40 @@@ BR=
  '
  
  LOCK(){
-   local lock timeout block
-   lock="${1}.lock"
-   timeout="${2-20}"
-   if [ \! -w "${lock%/*}" ] || [ -e "$lock" -a \! -d "$lock" ]; then
+   local lock="${1}.lock" timeout="${2-20}" block
+ 
+   if [ \! -w "${lock%/*}" ] || [ -e "$lock" -a \! -f "$lock" ]; then
      debug "Impossible to get lock: $lock"
      return 1
    fi
  
-   while ! mkdir "$lock" 2>&-; do
-     block="$(cat "$lock/pid" || printf 1)"
-     if ! { ps -eo pid |grep -qwF "$block"; }; then
-       debug "Overriding stale lock: $lock"
-       break
-     fi
-     if [ $timeout -le 0 ]; then
-       debug "Timeout while trying to get lock: $lock"
-       return 1
+   while [ $timeout -gt 0 ]; do
+     printf '%i\n' $$ >>"${lock}"
+     read block <"$lock"
+     if [ "$block" = $$ ]; then
+       return 0
+     elif ! { ps -eo pid |grep -qwF "$block"; }; then
+       debug "Trying to override stale lock: $lock"
+       if LOCK "$lock" 1; then
+         rm -- "$lock"
+         RELEASE "$lock"
+       fi
+     else
+       timeout=$((timeout - 1))
+       [ $timeout -gt 0 ] && sleep 1
      fi
-     timeout=$((timeout - 1))
-     sleep 1
    done
-   printf '%i\n' $$ >"${lock}/pid"
-   return 0
+ 
+   debug "Timeout while trying to get lock: $lock"
+   return 1
  }
  
  RELEASE(){
-   local lock
-   lock="${1}.lock"
-   if [ "$(cat "$lock/pid")" = "$$" ]; then
-     rm "$lock/pid"
-     if ! rmdir "$lock"; then
-       debug "Cannot remove tainted lock: $lock"
-       printf '%i\n' $$ >"${lock}/pid"
-       return 1
-     fi
+   local lock="${1}.lock" block
+ 
+   read block <"$lock"
+   if [ "$block" = $$ ]; then
+     rm -- "$lock"
      return 0
    else
      debug "Refusing to release foreign lock: $lock"
@@@ -67,11 -66,6 +66,6 @@@
    fi
  }
  
- # STRING='
- #   s;\\;\\\\;g; s;\t;\\t;g;
- #   s;\n;\\n;g;  s;\r;\\r;g;
- #   s;\+;\\+;g;  s; ;+;g;
- # '
  STRING(){
    local in out=''
    [ $# -gt 0 ] && in="$*" || in="$(cat)"
@@@ -84,19 -78,9 +78,9 @@@
      " "*) out="${out}+"; in="${in# }" ;;
      *) out="${out}${in%%[\\${CR}${BR}	+ ]*}"; in="${in#"${in%%[\\${BR}${CR}	+ ]*}"}" ;;
    esac; done
-   printf '%s' "$out"
+   printf '%s' "${out:-\\}"
  }
  
- UNSTRING='
-   :UNSTRING_X
-   s;((^|[^\\])(\\\\)*)\\n;\1\n;g;
-   s;((^|[^\\])(\\\\)*)\\t;\1\t;g;
-   s;((^|[^\\])(\\\\)*)\\r;\1\r;g;
-   s;((^|[^\\])(\\\\)*)\+;\1 ;g;
-   tUNSTRING_X;
-   s;((^|[^\\])(\\\\)*)\\\+;\1+;g;
-   s;\\\\;\\;g;
- '
  UNSTRING(){
    local in out=''
    [ $# -gt 0 ] && in="$*" || in="$(cat)"
@@@ -110,7 -94,7 +94,7 @@@
      \\*) in="${in#\\}" ;;
      *) out="${out}${in%%[\\+]*}"; in="${in#"${in%%[\\+]*}"}" ;;
    esac; done
-   printf '%s' "$out"
+   printf '%s\n' "$out"
  }
  
  DBM() {
@@@ -161,7 -145,7 +145,7 @@@
      update|replace)
        k="$1" key="$(STRING "$1")" value="$(STRING "$2")"
        LOCK "$file" || return 1
-       if ! DBM check "$k"; then
+       if ! DBM "$file" check "$k"; then
          RELEASE "$file"
          return 1
        fi
@@@ -178,7 -162,7 +162,7 @@@
      append)
        key="$(STRING "$1")" value="$(STRING "$2")"
        LOCK "$file" || return 1
-       if ! DBM check "$1"; then
+       if ! DBM "$file" check "$1"; then
          RELEASE "$file"
          return 1
        fi
diff --combined cgilite/users.sh
index 0000000,6a6833e..6a6833e
mode 000000,100755..100755
--- a/cgilite/users.sh
+++ b/cgilite/users.sh
@@@ -1,0 -1,599 +1,599 @@@
+ #!/bin/sh
+ 
+ [ -n "$include_users" ] && return 0
+ include_users="$0"
+ 
+ . "${_EXEC}/cgilite/session.sh"
+ . "${_EXEC}/cgilite/storage.sh"
+ 
+ SENDMAIL=${SENDMAIL-sendmail}
+ 
+ USER_REGISTRATION="${USER_REGISTRATION-true}"
+ USER_REQUIREEMAIL="${USER_REQUIREEMAIL-true}"
+ USER_ACCOUNTPAGE="${USER_ACCOUNTPAGE}"
+ 
+ USER_ACCOUNTEXPIRE="${USER_ACCOUNTEXPIRE:-$((86400 * 730))}"
+ USER_CONFIRMEXPIRE="${USER_CONFIRMEXPIRE:-86400}"
+ 
+ MAILFROM="${MAILDOMAIN-noreply@${HTTP_HOST%:*}}"
+ 
+ HTTP_HOST="$(HEADER Host)"
+ 
+ [ "$HTTPS" ] && SCHEMA=https || SCHEMA=http
+ 
+ # == FILE FORMAT ==
+ # UID	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE
+ #		(pending|active|deleted)
+ 
+ # == GLOBALS ==
+ UNSET_USER='unset \
+   USER_ID USER_NAME USER_STATUS USER_EMAIL USER_PWSALT USER_PWHASH \
+   USER_EXPIRE USER_DEVICES USER_FUTUREUSE
+ '
+ 
+ LOCAL_USER='local \
+   USER_ID USER_NAME USER_STATUS USER_EMAIL USER_PWSALT USER_PWHASH \
+   USER_EXPIRE USER_DEVICES USER_FUTUREUSE
+ '
+ 
+ unset USER_IDMAP
+ eval "$UNSET_USER"
+ 
+ user_db="${user_db:-${_DATA}/users.db}"
+ 
+ read_user() {
+   local user="$1"
+ 
+   # Global exports
+   USER_ID='' USER_NAME='' USER_STATUS='' USER_EMAIL='' USER_PWSALT=''
+   USER_PWHASH='' USER_EXPIRE='' USER_DEVICES='' USER_FUTUREUSE=''
+ 
+   if [ $# -eq 0 ]; then
+     read -r USER_ID USER_NAME USER_STATUS USER_EMAIL USER_PWSALT USER_PWHASH \
+             USER_EXPIRE USER_DEVICES USER_FUTUREUSE
+   elif [ "$user" -a -f "$user_db" -a -r "$user_db" ]; then
+     read -r USER_ID USER_NAME USER_STATUS USER_EMAIL USER_PWSALT USER_PWHASH \
+             USER_EXPIRE USER_DEVICES USER_FUTUREUSE <<-EOF
+ 	$(grep "^${user}	" "${user_db}")
+ 	EOF
+   fi
+   if [ "$USER_ID" -a "${USER_EXPIRE:-0}" -gt "$_DATE" ]; then
+        USER_NAME="$(UNSTRING "$USER_NAME")"
+       USER_EMAIL="$(UNSTRING "$USER_EMAIL")"
+     USER_DEVICES="$(UNSTRING "$USER_DEVICES")"
+     unset USER_PWSALT USER_PWHASH
+   else
+     eval "$UNSET_USER"
+     return 1
+   fi
+ }
+ 
+ update_user() {
+   # internal function for user update
+   local uid="$1" uname status email pwsalt pwhash expire devices futureuse
+   local UID_ UNAME STATUS EMAIL PWSALT PWHASH EXPIRE DEVICES FUTUREUSE
+   local arg
+ 
+   for arg in "$@"; do case $arg in
+     uname=*) uname="${arg#*=}";;
+     status=*) status="${arg#*=}";;
+     email=*) email="${arg#*=}";;
+     password=*) pwsalt="$(randomid)"; pwhash="$(user_pwhash "$pwsalt" "${arg#*=}")";;
+     expire=*) expire="${arg#*=}";;
+     devices=*) devices="${arg#*=}";;
+   esac; done
+ 
+   if LOCK "$user_db"; then
+     while read -r UID_ UNAME STATUS EMAIL PWSALT PWHASH EXPIRE DEVICES \
+                   FUTUREUSE; do
+     if [ "$UID_" = "$uid" ]; then
+       printf '%s	%s	%s	%s	%s	%s	%i	%s	%s\n' \
+              "$uid" "$(STRING "${uname-$(UNSTRING "$UNAME")}")" \
+              "${status:-${status-${STATUS}}${status+\\}}" \
+              "${email:-${email-${EMAIL}}${email+\\}}" \
+              "${pwsalt:-${PWSALT}}" "${pwhash:-${PWHASH}}" \
+              "${expire:-$((_DATE + USER_ACCOUNTEXPIRE))}" \
+              "$(STRING "${devices-$(UNSTRING "$DEVICES")}")" \
+              "${FUTUREUSE:-\\}"
+     elif [ "$STATUS" = pending -a ! "$EXPIRE" -ge "$_DATE" ]; then
+       # omit expired invitations from output
+       :
+     else
+       printf '%s	%s	%s	%s	%s	%s	%i	%s	%s\n' \
+              "$UID_" "$UNAME" "$STATUS" "$EMAIL" "$PWSALT" "$PWHASH" \
+              "$EXPIRE" "$DEVICES" "$FUTUREUSE"
+     fi
+     done <"$user_db" >"${user_db}.$$"
+     mv -- "${user_db}.$$" "$user_db"
+     RELEASE "$user_db"
+   else
+     return 1
+   fi
+ }
+ 
+ new_user(){
+   local user="${1:-$(timeid)}"
+   shift 1
+ 
+   if LOCK "$user_db"; then
+     if grep -q "^${user}	" "$user_db"; then
+       RELEASE "$user_db"
+       return 1
+     fi
+     printf '%s	\\	%s	\\	\\	\\	%i	\\	\\\n' \
+            "$user" "pending" "$(( _DATE + USER_CONFIRMEXPIRE ))" >>"$user_db"
+   else
+     return 1
+   fi
+ 
+   if [ $# -eq 0 ]; then
+     RELEASE "$user_db"
+     return 0
+   elif update_user "$user" "$@"; then
+     return 0
+   else
+     RELEASE "$user_db"
+     return 1
+   fi
+ }
+ 
+ user_idmap(){
+   local uid="$1" ret
+   eval "$LOCAL_USER"
+ 
+   if [ ! "$USER_IDMAP" ]; then
+     while read_user; do
+       USER_IDMAP="${USER_IDMAP}${USER_ID}	${USER_NAME}${BR}"
+     done <"$user_db"
+   fi
+   if [ "$uid" -a "$USER_IDMAP" != "${USER_IDMAP##*${uid}	}" ]; then
+     ret="${USER_IDMAP##*${uid}	}"; ret="${ret%%${BR}*}";
+     printf '%s\n' "$ret"
+     return 0
+   elif [ "$uid" ]; then
+     return 1
+   else
+     printf '%s' "$USER_IDMAP"
+     return 0
+   fi
+ }
+ 
+ user_idof(){
+   local name="$(STRING "$1")" ret
+   [ "$USER_IDMAP" ] || user_idmap >/dev/null
+ 
+   if [ "${name%\\}" -a "$USER_IDMAP" != "${USER_IDMAP%	${name}${BR}*}" ]; then
+     ret="${USER_IDMAP%	${name}${BR}*}"; ret="${ret##*${BR}}"
+     printf '%s\n' "$ret"
+     return 0
+   else
+     return 1
+   fi
+ }
+ 
+ user_checkname(){
+   { [ $# -gt 0 ] && printf %s "$*" || cat; } \
+   | sed -nE '
+     :X; $!{N;bX;}
+     s;[ \t\r\n]+; ;g;
+     s;^ ;;; s; $;;;
+     /@/d;
+     /^[a-zA-Z][a-zA-Z0-9 -~]{2,127}$/!d;
+     p;
+     '
+ }
+ 
+ user_checkemail(){
+   { [ $# -gt 0 ] && printf %s "$*" || cat; } \
+   | sed -nE '
+     # W3C recommended email regex
+     # https://html.spec.whatwg.org/multipage/input.html#email-state-(type=email)
+     /^[a-zA-Z0-9.!#$%&'\''*+\/=?^_`{|}~-]+@[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/p;
+     '
+ }
+ 
+ user_nameexist(){
+   local uname="$(STRING "$1")"
+   local UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE
+   [ -f "$user_db" -a -r "$user_db" ] \
+   && while read -r UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE; do
+     [ "$EXPIRE" -gt "$_DATE" -a "$UNAME" = "$uname" ] && return 0
+   done <"$user_db"
+   return 1
+ }
+ 
+ user_emailexist(){
+   local email="$(STRING "$1")"
+   local UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE
+   [ -f "$user_db" -a -r "$user_db" ] \
+   && while read -r UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE; do
+     [ "$EXPIRE" -gt "$_DATE" -a "$EMAIL" = "$email" ] && return 0
+   done <"$user_db"
+   return 1
+ }
+ 
+ user_pwhash(){
+   local salt="$1" secret="$2" hash
+   hash="$(printf '%s\n%s\n' "$secret" "$salt" |sha256sum)"
+   printf '%s\n' "${hash%% *}"
+ }
+ 
+ user_register(){
+   # reserve account, send registration mail
+   # preliminary uid, expiration, signature
+   local uid="$(timeid)"
+   local uname="$(POST uname |user_checkname)"
+   local email="$(POST email |user_checkemail)"
+   local pwsalt="$(randomid)"
+   local pw="$(POST pw |grep -m1 -xE '.{6,}' )" pwconfirm="$(POST pwconfirm)"
+ 
+   if [ "$USER_REGISTRATION" != true -a -s "$user_db" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}#ERROR_REGISTRATION_DISABLED"
+   fi
+ 
+   if   [ "$USER_REQUIREEMAIL" = true ]; then
+     if [ ! "email" ]; then
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_EMAIL_INVALID"
+     elif user_emailexist "$email"; then
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_EMAIL_EXISTS"
+     elif new_user "$uid" status=pending email="$email" expire="$((_DATE + USER_CONFIRMEXPIRE))"; then
+       debug "Sending Activation Link:" \
+             "${SCHEMA}://${HTTP_HOST}${_BASE}${PATH_INFO}?user_confirm=${uid}+$(session_mac "$uid")"
+       "$SENDMAIL" -t -f "$MAILFROM" <<-EOF
+ 	From: ${MAILFROM}
+ 	To: ${email}
+ 	Subject: Your account registration at ${HTTP_HOST%:*}
+ 
+ 	Someone tried to sign up for a user account using this email address.
+ 
+ 	You can activate your account using this link:
+ 
+ 	    ${SCHEMA}://${HTTP_HOST}${_BASE}${PATH_INFO}?user_confirm=${uid}+$(session_mac "$uid")
+ 
+ 	This registration link will expire after $((USER_CONFIRMEXPIRE / 3600)) hours.
+ 
+ 	If you did not request an account at ${HTTP_HOST%:*}, then someone else
+ 	probably entered your email address by accident. In this case you shoud
+ 	simply ignore this message and we will remove your email address from
+ 	our database within the next day.
+ 
+ 	This is an automatic email. Any direct reply will not be received.
+ 	Your Account Registration Robot.
+ 	EOF
+       REDIRECT "${_BASE}${PATH_INFO}#USER_REGISTER_CONFIRM"
+     else
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_USER_NOLOCK"
+     fi
+ 
+   elif [ "$USER_REQUIREEMAIL" != true ]; then
+     if [ ! "$uname" ]; then
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_UNAME_INVALID"
+     elif user_nameexist "$uname"; then
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_UNAME_EXISTS"
+     elif [ ! "$pw" ]; then
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_PW_EMPTYTOOSHORT"
+     elif [ "$pw" != "$pwconfirm" ]; then
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_PW_MISMATCH"
+     elif new_user "$uid" uname="$uname" status=active email="$email" password="$pw" expire="$((_DATE + USER_ACCOUNTEXPIRE))"; then
+       SESSION_COOKIE new
+       SESSION_BIND user_id "$uid"
+ 
+       if [ "$USER_ACCOUNTPAGE" ]; then
+         REDIRECT "${USER_ACCOUNTPAGE}"
+       else
+         REDIRECT "${_BASE}${PATH_INFO}#USER_REGISTER_CONFIRM"
+       fi
+     else
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_USER_NOLOCK"
+     fi
+   fi
+ }
+ 
+ user_invite(){
+   local uid="$(timeid)"
+   local email="$(POST email |user_checkemail)"
+   local message="$(POST message)"
+ 
+   if [ ! "email" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}#ERROR_EMAIL_INVALID"
+   elif user_emailexist "$email"; then
+     REDIRECT "${_BASE}${PATH_INFO}#ERROR_EMAIL_EXISTS"
+   elif new_user "$uid" status=pending email="$email" expire="$((_DATE + USER_CONFIRMEXPIRE))"; then
+     debug "Sending Invitation Link:" \
+           "${SCHEMA}://${HTTP_HOST}${_BASE}${PATH_INFO}?user_confirm=${uid}+$(session_mac "$uid")"
+     "$SENDMAIL" -t -f "$MAILFROM" <<-EOF
+ 	From: ${MAILFROM}
+ 	To: ${email}
+ 	Subject: You have been invited to ${HTTP_HOST%:*}
+ 
+ 	${USER_NAME:-Someone} has offered an invitation to this email address.
+ 
+ 	${message}
+ 
+ 	You can create your account using this link:
+ 
+ 	    ${SCHEMA}://${HTTP_HOST}${_BASE}${PATH_INFO}?user_confirm=${uid}+$(session_mac "$uid")
+ 
+ 	This registration link will expire after $((USER_CONFIRMEXPIRE / 3600)) hours.
+ 
+ 	If you do not know what this is about, then someone else probably
+ 	entered your email address by accident. In this case you shoud
+ 	simply ignore this message and we will remove your email address from
+ 	our database within the next day.
+ 
+ 	This is an automatic email. Any direct reply will not be received.
+ 	Your Account Registration Robot.
+ 	EOF
+     REDIRECT "${_BASE}${PATH_INFO}#USER_REGISTER_CONFIRM"
+   else
+     REDIRECT "${_BASE}${PATH_INFO}#ERROR_USER_NOLOCK"
+   fi
+ }
+ 
+ user_confirm(){
+   # enable account
+   eval "$LOCAL_USER"
+   local uid="$(POST uid |checkid || printf invalid)"
+   local signature="$(POST signature)"
+   local uname="$(POST uname |user_checkname)"
+   local pwsalt="$(randomid)"
+   local pw="$(POST pw |grep -m1 -xE '.{6,}' )" pwconfirm="$(POST pwconfirm)"
+ 
+   read_user "${uid}"
+ 
+   if [ "$signature" != "$(session_mac "$uid")" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}?${QUERY_STRING}#ERROR_LINK_INVALID"
+   elif [ ! "$uname" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}?${QUERY_STRING}#ERROR_UNAME_INVALID"
+   elif user_nameexist "$uname"; then
+     REDIRECT "${_BASE}${PATH_INFO}?${QUERY_STRING}#ERROR_UNAME_EXISTS"
+   elif [ ! "$pw" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}?${QUERY_STRING}#ERROR_PW_EMPTYTOOSHORT"
+   elif [ "$pw" != "$pwconfirm" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}?${QUERY_STRING}#ERROR_PW_MISMATCH"
+   elif [ "$USER_STATUS" != pending -o \! "$USER_EXPIRE" -gt "$_DATE" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}?${QUERY_STRING}#ERROR_LINK_INVALID"
+   elif update_user "$USER_ID" uname="$uname" status=active password="$pw"; then
+     SESSION_COOKIE new
+     SESSION_BIND user_id "$USER_ID"
+     if [ "$USER_ACCOUNTPAGE" ]; then
+       REDIRECT "${USER_ACCOUNTPAGE}"
+     else
+       REDIRECT "${_BASE}${PATH_INFO}?user_register=confirm#USER_REGISTER_CONFIRM"
+     fi
+   else
+     REDIRECT "${_BASE}${PATH_INFO}#ERROR_USER_NOLOCK"
+   fi
+ }
+ 
+ user_login(){
+   # set cookie
+   # keep logged in - device cookie?
+   # initialize new session!
+   local UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE
+   local uname="$(POST uname |STRING)" pw="$(POST pw)"
+ 
+   [ -f "$user_db" -a -r "$user_db" ] \
+   && while read -r UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE; do
+     if [ "$UNAME" = "$uname" -o "$EMAIL" = "$uname" ]; then
+       if [ "$STATUS" = active -a "$EXPIRE" -gt "$_DATE" -a "$PWHASH" = "$(user_pwhash "$PWSALT" "$pw")" ]; then
+         SESSION_COOKIE new
+         SESSION_BIND user_id "$UID_"
+         REDIRECT "${_BASE}${PATH_INFO}#USER_LOGGED_IN"
+       fi
+     fi
+   done <"$user_db"
+   REDIRECT "${_BASE}${PATH_INFO}#ERROR_INVALID_LOGIN"
+ }
+ 
+ user_logout(){
+   # destroy cookie, destroy session
+   # keep device cookie
+   new_session
+   SESSION_COOKIE new
+   SET_COOKIE 0 user_id="" Path="/${_BASE#/}" SameSite=Strict HttpOnly
+   REDIRECT "${_BASE}${PATH_INFO}#USER_LOGGED_OUT"
+ }
+ 
+ user_update(){
+   # todo: username update, email update / email confirm
+   local UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE
+   # local uname="$(POST uname |STRING)"
+   local uid oldpw pw pwconfirm
+ 
+         uid="$(POST uid)"
+       oldpw="$(POST oldpw)"
+          pw="$(POST pw |grep -xE '.{6}')"
+   pwconfirm="$(POST pwconfirm)"
+ 
+ 
+   read -r UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE <<-EOF
+ 	$(grep "^${uid}	" "$user_db")
+ 	EOF
+ 
+   if [ "$UID_" = "$USER_ID" -a "$PWHASH" = "$(user_pwhash "$PWSALT" "$oldpw")" ]; then
+     if [ "$pw" -a "$pw" = "$pwconfirm" ]; then
+       update_user "${uid}" password="$pw"
+       REDIRECT "${_BASE}${PATH_INFO}#UPDATE_SUCCESS"
+     else
+       REDIRECT "${_BASE}${PATH_INFO}#ERROR_PWMISMATCH"
+     fi
+   elif [ "$UID_" = "$USER_ID" ]; then
+     REDIRECT "${_BASE}${PATH_INFO}#ERROR_INVALID_AUTH_PASSWORD"
+   else
+     REDIRECT "${_BASE}${PATH_INFO}#ERROR_NOTLOGGEDIN"
+   fi
+ }
+ 
+ user_recover(){
+   # send recover link
+   :
+ }
+ user_disable(){
+   :
+ }
+ 
+ read_user "$(SESSION_VAR user_id)"
+ [ "$USER_STATUS" -a "$USER_STATUS" != active ] && eval $UNSET_USER
+ 
+ [ "$REQUEST_METHOD" = POST ] && case "$(POST action)" in
+   user_register) user_register ;;
+   user_confirm)  user_confirm ;;
+   user_invite)   user_invite ;;
+   user_login)    user_login ;;
+   user_logout)   user_logout ;;
+   user_update)   user_update ;;
+   user_recover)
+     :;;
+   user_disable)
+     :;;
+ esac
+ 
+ export USER_ID USER_NAME USER_STATUS USER_EMAIL USER_PWSALT USER_PWHASH \
+        USER_EXPIRE USER_DEVICES USER_FUTUREUSE
+ 
+ 
+ w_user_update(){
+   if [ ! "$USER_ID" ]; then
+     cat <<-EOF
+ 	[div #user_update .nouser
+ 	This page can only be used by registered users
+ 	]
+ 	EOF
+   else
+     cat <<-EOF
+ 	[form #user_update method=POST
+ 	  [hidden "uid" "$USER_ID"]
+ 	  [p .username Logged in as $USER_NAME]
+ 	  [input type=password name=oldpw placeholder="Current Passphrase"]
+ 	  [input type=password name=pw placeholder="New Passphrase" pattern=".{6,}"]
+ 	  [input type=password name=pwconfirm placeholder="Confirm New Passphrase" pattern=".{6,}"]
+ 	  [submit "action" "user_update" Update Passphrase]
+ 	]
+ 	EOF
+   fi
+ }
+ 
+ w_user_register(){
+   if [ "$(GET user_confirm)" ]; then
+     w_user_confirm
+   elif [ "$USER_REGISTRATION" != true -a -s "$user_db" ]; then
+     cat <<-EOF
+ 	[div #user_register .disabled
+ 	User Registration is disabled.
+ 	]
+ 	EOF
+   elif [ "$USER_REQUIREEMAIL" = true ]; then
+     cat <<-EOF
+ 	[form #user_register .registeremail method=POST
+ 	  [p We will send an activation mail to your email address.
+ 	    You can continue the signup process when you click on the
+ 	    activation link in this email.]
+ 	  [input type=email name=email placeholder="Email"]
+ 	  [submit "action" "user_register" Sign Up]
+ 	]
+ 	EOF
+   elif [ "$USER_REQUIREEMAIL" != true ]; then
+     cat <<-EOF
+ 	[form #user_register .registername method=POST
+           [input name=uname placeholder="Choose Username" tooltip="Your username may contain any character but the @ sign. It must be at least 3 characters long, and it must start with a letter." pattern="^\[\\\\p{L}\]\[\\\\p{L}0-9 -~\]{2,127}$" autocomplete=off]
+ 	  [input type=password name=pw placeholder="Choose Passphrase" pattern=".{6,}"]
+ 	  [input type=password name=pwconfirm placeholder="Confirm Passphrase" pattern=".{6,}"]
+ 	  [submit "action" "user_register" Sign Up]
+ 	]
+ 	EOF
+   fi
+ }
+ 
+ w_user_confirm(){
+   local UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE
+   local user_confirm="$(GET user_confirm)"
+   local uid="${user_confirm% *}" signature="${user_confirm#* }"
+ 
+   if [ "$signature" = "$(session_mac "$uid")" ]; then
+     read -r UID_	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE <<-EOF
+ 	$(grep "^${uid}	" "$user_db")
+ 	EOF
+     if [ "$STATUS" = pending -a "$EXPIRE" -gt "$_DATE" ]; then
+       cat <<-EOF
+ 	[form #user_confirm method=POST
+ 	  [input type=hidden name=uid value="${uid}"]
+ 	  [input type=hidden name=signature value="${signature}"]
+ 	  $([ "$EMAIL" != '\' ] && printf \
+ 	    '[input disabled=disabled value="%s" placeholder="Email"]' "$(UNSTRING "$EMAIL" |HTML)"
+ 	  )
+           [input name=uname placeholder="Choose Username" tooltip="Your username may contain any character but the @ sign. It must be at least 3 characters long, and it must start with a letter." pattern="^\[\\\\p{L}\]\[\\\\p{L}0-9 -~\]{2,127}$" autocomplete=off]
+ 	  [input type=password name=pw placeholder="Choose Passphrase" pattern=".{6,}"]
+ 	  [input type=password name=pwconfirm placeholder="Confirm Passphrase" pattern=".{6,}"]
+ 	  [submit "action" "user_confirm" Finish Registration]
+ 	]
+ 	EOF
+     else
+       cat <<-EOF
+ 	[div #user_confirm .expired
+ 	  [p This activation link is not valid anymore.]
+ 	]
+ 	EOF
+     fi
+   else
+     cat <<-EOF
+ 	[div #user_confirm .invalid
+ 	  [p This activation link is invalid. Make sure you copied the whole activation link from your email and be careful not to include any line breaks.]
+ 	]
+ 	EOF
+   fi
+ }
+ 
+ w_user_invite(){
+   local uid invlink
+ 
+   if [ "$(GET user_confirm)" ]; then
+     w_user_confirm
+   elif [ "$USER_ID" -a "$SENDMAIL" ]; then
+     cat <<-EOF
+ 	[form #user_invite method=POST
+ 	  [input placeholder="Email Recipient" name=email autocomplete=off]
+ 	  [textarea name="message" placeholder="Message to recipient" . ]
+ 	  [submit "action" "user_invite" Send Invitation]
+ 	]
+ 	EOF
+   elif [ "$USER_ID" ]; then
+     uid="$(timeid)"
+     new_user "$uid" status=pending expire="$((_DATE + USER_CONFIRMEXPIRE))"
+     invlink="${SCHEMA}://${HTTP_HOST}${_BASE}${PATH_INFO}?user_confirm=${uid}+$(session_mac "$uid")"
+     debug "New Invitation Link: $invlink"
+     cat <<-EOF
+ 	[div #user_invite .link
+           [p An anonymous user account has been set up. Send the following link to the intended user, so they may claim their account. The link will remain valid for $((USER_CONFIRMEXPIRE / 3600)) hours.]
+           [a href="$(HTML "$invlink")" . $(HTML "$invlink")]
+ 
+           [p [a href="#" . Set up another account]]
+ 	]
+ 	EOF
+   else
+     cat <<-EOF
+ 	[div #user_invite .notallowed
+ 	  Only registered users may send an invitation to another user.
+ 	]
+ 	EOF
+   fi
+ }
+ 
+ w_user_login(){
+   if [ ! "$USER_ID" ]; then
+     cat <<-EOF
+ 	[form #user_login .login method=POST
+ 	  [input name=uname placeholder="Username or Email" autocomplete=off]
+ 	  [input type=password name=pw placeholder="Passphrase"]
+ 	  [submit "action" "user_login" Login]
+ 	]
+ 	EOF
+   elif [ "$USER_ID" ]; then
+     cat <<-EOF
+ 	[form #user_login .logout method=POST
+ 	  [p Logged in as [span . $(HTML ${USER_NAME})]]
+ 	  [submit "action" "user_logout" Logout]
+ 	]
+ 	EOF
+   fi
+ }