diff --git a/lam/lib/modules/sambaSamAccount.inc b/lam/lib/modules/sambaSamAccount.inc
index 8d146547d..c4f9d59bb 100644
--- a/lam/lib/modules/sambaSamAccount.inc
+++ b/lam/lib/modules/sambaSamAccount.inc
@@ -1,5 +1,6 @@
 <?php
 
+use LAM\REMOTE\Remote;
 use LAM\TYPES\ConfiguredType;
 use function LAM\ACCOUNTLIST\isPasswordChangeByDefault;
 
@@ -48,12 +49,12 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 	/**
 	 * ID for locked account status.
 	 */
-	const STATUS_ACCOUNT_LOCKED = "SAMBA_ACCOUNT_LOCKED";
+	private const STATUS_ACCOUNT_LOCKED = "SAMBA_ACCOUNT_LOCKED";
 
 	/**
 	 * ID for locked account status.
 	 */
-	const STATUS_ACCOUNT_DEACTIVATED = "SAMBA_ACCOUNT_DEACTIVATED";
+	private const STATUS_ACCOUNT_DEACTIVATED = "SAMBA_ACCOUNT_DEACTIVATED";
 
 	/**
 	 * These attributes will be ignored by default if a new account is copied from an existing one.
@@ -182,7 +183,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$return['extensions'] = ['hash', 'iconv'];
 		// profile options
 		$profileContainer = new htmlResponsiveRow();
-		$profileContainer->add(new htmlResponsiveInputCheckbox('sambaSamAccount_addExt', false, _('Automatically add this extension'), 'autoAdd'), 12);
+		$profileContainer->add(new htmlResponsiveInputCheckbox('sambaSamAccount_addExt', false, _('Automatically add this extension'), 'autoAdd'));
 		$return['profile_options'] = $profileContainer;
 		// profile checks
 		$return['profile_checks']['sambaSamAccount_smbhome'] = [
@@ -618,7 +619,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		}
 		if ($this->get_scope() == "host") {
 			$attrs = $this->getAccountContainer()->getAccountModule('posixAccount')->getAttributes();
-			if (substr($attrs['uid'][0], -1, 1) != '$') {
+			if (!str_ends_with($attrs['uid'][0], '$')) {
 				return false;
 			}
 		}
@@ -861,7 +862,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				// change only if not yet set, previously set to special SID or domain changed
 				if (!isset($this->attributes['sambaSID'][0])
 					|| in_array($rid, $this->userRids)
-					|| (strpos($this->attributes['sambaSID'][0], $SID) === false)) {
+					|| (!str_contains($this->attributes['sambaSID'][0], $SID))) {
 					$this->attributes['sambaSID'][0] = $SID . "-" . (($attrs['uidNumber'][0] * 2) + $RIDbase);
 				}
 			}
@@ -980,23 +981,23 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$buttonName = '';
 		$postKeys = array_keys($_POST);
 		for ($i = 0; $i < sizeof($postKeys); $i++) {
-			if (strpos($postKeys[$i], 'form_subpage_sambaSamAccount_attributes_') !== false) {
+			if (str_contains($postKeys[$i], 'form_subpage_sambaSamAccount_attributes_')) {
 				$buttonName = $postKeys[$i];
 			}
 		}
-		if (($buttonName == '') || (strpos($buttonName, '_back') !== false)) {
+		if (($buttonName == '') || (str_contains($buttonName, '_back'))) {
 			return [];
 		}
 		// get attribute name
 		$attr = '';
-		if (strpos($buttonName, 'sambaKickoffTime') !== false) {
+		if (str_contains($buttonName, 'sambaKickoffTime')) {
 			$attr = 'sambaKickoffTime';
 		}
 		if ($attr == '') {
 			return [];
 		}
 		// determine action
-		if (strpos($buttonName, '_change') !== false) {
+		if (str_contains($buttonName, '_change')) {
 			// set new time
 			$this->setExpirationDate($_POST['expire_yea'], $_POST['expire_mon'], $_POST['expire_day']);
 			// sync other modules
@@ -1017,7 +1018,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					$_POST['expire_yea'], $_POST['expire_mon'], $_POST['expire_day']);
 			}
 		}
-		elseif (strpos($buttonName, '_del') !== false) {
+		elseif (str_contains($buttonName, '_del')) {
 			// remove attribute value
 			unset($this->attributes[$attr]);
 			// sync other modules
@@ -1085,8 +1086,8 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		if ($this->isExtensionEnabled()) {
 			if ($this->get_scope() == "host") {
 				$attrs = $this->getAccountContainer()->getAccountModule('posixAccount')->getAttributes();
-				if (substr($attrs['uid'][0], -1, 1) != '$') {
-					$return->add(new htmlStatusMessage("ERROR", _('Host name must end with $!'), _('Please check your settings on the Unix page!')), 12);
+				if (!str_ends_with($attrs['uid'][0], '$')) {
+					$return->add(new htmlStatusMessage("ERROR", _('Host name must end with $!'), _('Please check your settings on the Unix page!')));
 				}
 			}
 			$personalAttributes = [];
@@ -1096,7 +1097,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			// Get Domain SID from user SID
 			$sambaDomains = $this->getDomains();
 			if (sizeof($sambaDomains) == 0) {
-				$return->add(new htmlStatusMessage("ERROR", _('No Samba 3 domains found in LDAP! Please create one first.')), 12);
+				$return->add(new htmlStatusMessage("ERROR", _('No Samba 3 domains found in LDAP! Please create one first.')));
 				return $return;
 			}
 			if (isset($this->attributes['sambaSID'][0]) && $this->attributes['sambaSID'][0] != '') {
@@ -1131,20 +1132,20 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					$displayName = $personalAttributes['sn'][0];
 				}
 			}
-			$return->add(new htmlResponsiveInputField(_('Display name'), 'displayName', $displayName, 'displayName'), 12);
+			$return->add(new htmlResponsiveInputField(_('Display name'), 'displayName', $displayName, 'displayName'));
 			if ($this->get_scope() == 'user') {
 				// user account
-				$return->add(new htmlHiddenInput('sambaAcctFlagsU', 'true'), 12);
+				$return->add(new htmlHiddenInput('sambaAcctFlagsU', 'true'));
 				// no password
-				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsN', $this->nopwd, _('Use no password'), 'noPassword'), 12);
+				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsN', $this->nopwd, _('Use no password'), 'noPassword'));
 				// no password expiry
-				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsX', $this->noexpire, _('Password does not expire'), 'noExpire'), 12);
+				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsX', $this->noexpire, _('Password does not expire'), 'noExpire'));
 				// account deactivated
-				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsD', $this->isDeactivated(), _('Account is deactivated'), 'deactivated'), 12);
+				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsD', $this->isDeactivated(), _('Account is deactivated'), 'deactivated'));
 				// account locked
-				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsL', $this->isLocked(), _('Account is locked'), 'locked'), 12);
+				$return->add(new htmlResponsiveInputCheckbox('sambaAcctFlagsL', $this->isLocked(), _('Account is locked'), 'locked'));
 				// password change at next login
-				$return->add(new htmlResponsiveInputCheckbox('forcePasswordChangeOption', $this->expirePassword, _('Password change at next login'), 'passwordIsExpired'), 12);
+				$return->add(new htmlResponsiveInputCheckbox('forcePasswordChangeOption', $this->expirePassword, _('Password change at next login'), 'passwordIsExpired'));
 				// last password change
 				if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideSambaPwdLastSet')) {
 					$sambaPwdLastSet = null;
@@ -1183,7 +1184,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				$expireDateGroup->addElement(new htmlSpacer('0.5rem', null));
 				$expireDateGroup->addElement(new htmlAccountPageButton(static::class, 'time', 'sambaKickoffTime', _('Change')));
 				$expireDateGroup->addElement(new htmlSpacer('0.5rem', null));
-				$expireDateGroup->addElement(new htmlHelpLink('expireDate'), true);
+				$expireDateGroup->addElement(new htmlHelpLink('expireDate'));
 				$return->addField($expireDateGroup);
 				// home drive
 				if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideHomeDrive')) {
@@ -1197,7 +1198,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					else {
 						$selected = ['-'];
 					}
-					$return->add(new htmlResponsiveSelect('sambaHomeDrive', $drives, $selected, _('Home drive'), 'homeDrive'), 12);
+					$return->add(new htmlResponsiveSelect('sambaHomeDrive', $drives, $selected, _('Home drive'), 'homeDrive'));
 				}
 				// home path
 				if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideHomePath')) {
@@ -1205,7 +1206,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					if (isset($this->attributes['sambaHomePath'][0])) {
 						$sambaHomePath = $this->attributes['sambaHomePath'][0];
 					}
-					$return->add(new htmlResponsiveInputField(_('Home path'), 'sambaHomePath', $sambaHomePath, 'homePath'), 12);
+					$return->add(new htmlResponsiveInputField(_('Home path'), 'sambaHomePath', $sambaHomePath, 'homePath'));
 				}
 				// profile path
 				if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideProfilePath')) {
@@ -1232,7 +1233,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					if (isset($this->attributes['sambaLogonScript'][0])) {
 						$sambaLogonScript = $this->attributes['sambaLogonScript'][0];
 					}
-					$return->add(new htmlResponsiveInputField(_('Logon script'), 'sambaLogonScript', $sambaLogonScript, 'scriptPath'), 12);
+					$return->add(new htmlResponsiveInputField(_('Logon script'), 'sambaLogonScript', $sambaLogonScript, 'scriptPath'));
 				}
 				if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideWorkstations')) {
 					$return->addLabel(new htmlOutputText(_('Samba workstations')));
@@ -1259,7 +1260,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				if (!$wrid) {
 					$selected[] = $this->getGroupName($attrs['gidNumber'][0]);
 				}
-				$return->add(new htmlResponsiveSelect('sambaPrimaryGroupSID', $options, $selected, _('Windows group'), 'group'), 12);
+				$return->add(new htmlResponsiveSelect('sambaPrimaryGroupSID', $options, $selected, _('Windows group'), 'group'));
 				// display if group SID should be mapped to a well known SID
 				$options = array_keys($this->userRids);
 				$options[] = '-';
@@ -1277,10 +1278,10 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				else {
 					$selected[] = "-";
 				}
-				$return->add(new htmlResponsiveSelect('sambaSID', $options, $selected, _('Special user'), 'specialUser'), 12);
+				$return->add(new htmlResponsiveSelect('sambaSID', $options, $selected, _('Special user'), 'specialUser'));
 			}
 			// domain
-			$return->add(new htmlResponsiveSelect('sambaDomainName', $sambaDomainNames, $sel_domain, _('Domain'), 'domain'), 12);
+			$return->add(new htmlResponsiveSelect('sambaDomainName', $sambaDomainNames, $sel_domain, _('Domain'), 'domain'));
 			// logon hours and terminal server options
 			if ($this->get_scope() == 'user') {
 				if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideLogonHours')) {
@@ -1303,7 +1304,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			// reset host password
 			if ($this->get_scope() == 'host') {
 				// host account
-				$return->add(new htmlHiddenInput('sambaAcctFlagsW', 'true'), 12);
+				$return->add(new htmlHiddenInput('sambaAcctFlagsW', 'true'));
 				// password reset
 				$return->addLabel(new htmlOutputText(_('Reset password')));
 				$resetPasswordGroup = new htmlGroup();
@@ -1320,7 +1321,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			$return->add($remButton, 12, 12, 12, 'text-center');
 		}
 		else {
-			$return->add(new htmlButton('addObjectClass', _('Add Samba 3 extension')), 12);
+			$return->add(new htmlButton('addObjectClass', _('Add Samba 3 extension')));
 		}
 		return $return;
 	}
@@ -1367,7 +1368,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			}
 			$availableUserWorkstations = array_delete($userWorkstations, $availableUserWorkstations);
 
-			$return->add(new htmlSubTitle(_("Allowed workstations")), 12);
+			$return->add(new htmlSubTitle(_("Allowed workstations")));
 
 			$userWorkstationsOptions = [];
 			foreach ($userWorkstations as $userWorkstation) {
@@ -1382,7 +1383,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			$return->addVerticalSpacer('2rem');
 
 			$backButton = new htmlAccountPageButton(static::class, 'attributes', 'back', _('Back'));
-			$return->add($backButton, 12);
+			$return->add($backButton);
 		}
 		return $return;
 	}
@@ -1443,7 +1444,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			}
 			$data[] = $row;
 		}
-		$return->add(new htmlResponsiveTable($titles, $data), 12);
+		$return->add(new htmlResponsiveTable($titles, $data));
 
 		$return->addVerticalSpacer('2rem');
 		$return->addLabel(new htmlAccountPageButton(static::class, 'attributes', 'submit', _('Ok')));
@@ -1489,16 +1490,16 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$dateGroup->addElement(new htmlHelpLink($help));
 		$return->addField($dateGroup);
 		if ($this->getAccountContainer()->getAccountModule('shadowAccount') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncShadow', false, _('Set also for Shadow')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncShadow', false, _('Set also for Shadow')));
 		}
 		if ($this->getAccountContainer()->getAccountModule('heimdalKerberos') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncHeimdal', false, _('Set also for Kerberos')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncHeimdal', false, _('Set also for Kerberos')));
 		}
 		if ($this->getAccountContainer()->getAccountModule('mitKerberos') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncMIT', false, _('Set also for Kerberos')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncMIT', false, _('Set also for Kerberos')));
 		}
 		if ($this->getAccountContainer()->getAccountModule('mitKerberosStructural') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncMITStructural', false, _('Set also for Kerberos')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncMITStructural', false, _('Set also for Kerberos')));
 		}
 		$return->addVerticalSpacer('2rem');
 		$buttons = new htmlGroup();
@@ -1525,9 +1526,9 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			$mDial->load($this->attributes['sambaMungedDial'][0]);
 		}
 		// terminal server login
-		$return->add(new htmlResponsiveInputCheckbox('tsAllowLogin', $mDial->getTsLogin(), _('Allow terminal server login'), 'tsAllowLogin'), 12);
+		$return->add(new htmlResponsiveInputCheckbox('tsAllowLogin', $mDial->getTsLogin(), _('Allow terminal server login'), 'tsAllowLogin'));
 		// home directory
-		$return->add(new htmlResponsiveInputField(_('Home directory'), 'tsHomeDir', $mDial->ctx['CtxWFHomeDir'], 'tsHomeDir'), 12);
+		$return->add(new htmlResponsiveInputField(_('Home directory'), 'tsHomeDir', $mDial->ctx['CtxWFHomeDir'], 'tsHomeDir'));
 		// home drive
 		$drives = [];
 		for ($i = 90; $i > 67; $i--) {
@@ -1537,33 +1538,33 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		if (isset($mDial->ctx['CtxWFHomeDirDrive'])) {
 			$selTsDrive = [$mDial->ctx['CtxWFHomeDirDrive']];
 		}
-		$return->add(new htmlResponsiveSelect('tsHomeDrive', $drives, $selTsDrive, _('Home drive'), 'homeDrive'), 12);
+		$return->add(new htmlResponsiveSelect('tsHomeDrive', $drives, $selTsDrive, _('Home drive'), 'homeDrive'));
 		// profile path
-		$return->add(new htmlResponsiveInputField(_('Profile path'), 'tsProfilePath', $mDial->ctx['CtxWFProfilePath'], 'tsProfilePath'), 12);
+		$return->add(new htmlResponsiveInputField(_('Profile path'), 'tsProfilePath', $mDial->ctx['CtxWFProfilePath'], 'tsProfilePath'));
 		// use startup program and working dir from client
-		$return->add(new htmlResponsiveInputCheckbox('tsInherit', $mDial->getInheritMode(), _('Inherit client startup configuration'), 'tsInherit'), 12);
+		$return->add(new htmlResponsiveInputCheckbox('tsInherit', $mDial->getInheritMode(), _('Inherit client startup configuration'), 'tsInherit'));
 		// startup program
-		$return->add(new htmlResponsiveInputField(_('Initial program'), 'tsInitialProgram', $mDial->ctx['CtxInitialProgram'], 'tsInitialProgram'), 12);
+		$return->add(new htmlResponsiveInputField(_('Initial program'), 'tsInitialProgram', $mDial->ctx['CtxInitialProgram'], 'tsInitialProgram'));
 		// working dir
-		$return->add(new htmlResponsiveInputField(_('Working directory'), 'tsWorkDirectory', $mDial->ctx['CtxWorkDirectory'], 'tsWorkDirectory'), 12);
+		$return->add(new htmlResponsiveInputField(_('Working directory'), 'tsWorkDirectory', $mDial->ctx['CtxWorkDirectory'], 'tsWorkDirectory'));
 		// connection time limit
 		$tsConnectionLimit = new htmlResponsiveInputField(_('Connection time limit'), 'tsConnectionLimit', $mDial->ctx['CtxMaxConnectionTime'], 'tsTimeLimit');
 		$tsConnectionLimit->setType('number');
-		$return->add($tsConnectionLimit, 12);
+		$return->add($tsConnectionLimit);
 		// disconnection time limit
 		$tsDisconnectionLimit = new htmlResponsiveInputField(_('Disconnection time limit'), 'tsDisconnectionLimit', $mDial->ctx['CtxMaxDisconnectionTime'], 'tsTimeLimit');
 		$tsDisconnectionLimit->setType('number');
-		$return->add($tsDisconnectionLimit, 12);
+		$return->add($tsDisconnectionLimit);
 		// idle time limit
 		$tsIdleLimit = new htmlResponsiveInputField(_('Idle time limit'), 'tsIdleLimit', $mDial->ctx['CtxMaxIdleTime'], 'tsTimeLimit');
 		$tsIdleLimit->setType('number');
-		$return->add($tsIdleLimit, 12);
+		$return->add($tsIdleLimit);
 		// connect client drives
-		$return->add(new htmlResponsiveInputCheckbox('tsConnectDrives', $mDial->getConnectClientDrives(), _('Connect client drives'), 'tsConnectDrives'), 12);
+		$return->add(new htmlResponsiveInputCheckbox('tsConnectDrives', $mDial->getConnectClientDrives(), _('Connect client drives'), 'tsConnectDrives'));
 		// connect client printers
-		$return->add(new htmlResponsiveInputCheckbox('tsConnectPrinters', $mDial->getConnectClientPrinters(), _('Connect client printers'), 'tsConnectPrinters'), 12);
+		$return->add(new htmlResponsiveInputCheckbox('tsConnectPrinters', $mDial->getConnectClientPrinters(), _('Connect client printers'), 'tsConnectPrinters'));
 		// client printer is default
-		$return->add(new htmlResponsiveInputCheckbox('tsClientPrinterDefault', $mDial->getDefaultPrinter(), _('Client printer is default'), 'tsClientPrinterDefault'), 12);
+		$return->add(new htmlResponsiveInputCheckbox('tsClientPrinterDefault', $mDial->getDefaultPrinter(), _('Client printer is default'), 'tsClientPrinterDefault'));
 		// shadowing
 		$shadowOptions = [
 			_("disabled") => "0",
@@ -1574,7 +1575,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$selShadow = [$mDial->getShadow()];
 		$shadowSelect = new htmlResponsiveSelect('tsShadowing', $shadowOptions, $selShadow, _('Shadowing'), 'tsShadowing');
 		$shadowSelect->setHasDescriptiveElements(true);
-		$return->add($shadowSelect, 12);
+		$return->add($shadowSelect);
 		// broken connection
 		$brokenConnOptions = [
 			_("disconnect") => "0",
@@ -1582,7 +1583,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$selbrokenConn = [$mDial->getBrokenConn()];
 		$brokenConnSelect = new htmlResponsiveSelect('tsBrokenConn', $brokenConnOptions, $selbrokenConn, _('On broken or timed out connection'), 'tsBrokenConn');
 		$brokenConnSelect->setHasDescriptiveElements(true);
-		$return->add($brokenConnSelect, 12);
+		$return->add($brokenConnSelect);
 		// reconnect
 		$reconnectOptions = [
 			_("from any client") => "0",
@@ -1590,7 +1591,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$selReconnect = [$mDial->getReConn()];
 		$reconnectSelect = new htmlResponsiveSelect('tsReconnect', $reconnectOptions, $selReconnect, _('Reconnect if disconnected'), 'tsReconnect');
 		$reconnectSelect->setHasDescriptiveElements(true);
-		$return->add($reconnectSelect, 12);
+		$return->add($reconnectSelect);
 		// buttons
 		$return->addVerticalSpacer('2rem');
 		$return->addLabel(new htmlAccountPageButton(static::class, 'attributes', 'submit', _('Ok')));
@@ -1613,12 +1614,12 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		for ($i = 0; $i < sizeof($remoteServers); $i++) {
 			$remoteServer = $remoteServers[$i];
 			$label = $remoteServer->getLabel();
-			$remote = new \LAM\REMOTE\Remote();
+			$remote = new Remote();
 			try {
 				$remote->connect($remoteServer);
 			}
 			catch (LAMException $e) {
-				$return->add(new htmlStatusMessage('ERROR', $e->getTitle(), $e->getMessage()), 12);
+				$return->add(new htmlStatusMessage('ERROR', $e->getTitle(), $e->getMessage()));
 				continue;
 			}
 			$result = $remote->execute(
@@ -1661,7 +1662,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					else {
 						$message = new htmlStatusMessage('WARN', htmlspecialchars($messageParams[0]));
 					}
-					$return->add($message, 12);
+					$return->add($message);
 				}
 			}
 		}
@@ -1682,14 +1683,14 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$uidNumber = $unixAttrs['uidNumber'][0];
 		$gidNumber = $unixAttrs['gidNumber'][0];
 		if (empty($uidNumber) || empty($gidNumber)) {
-			return;
+			return $return;
 		}
 		// get list of remote servers
 		$remoteServers = $_SESSION['config']->getConfiguredScriptServers();
 		for ($i = 0; $i < sizeof($remoteServers); $i++) {
 			$remoteServer = $remoteServers[$i];
 			if (isset($_POST['form_subpage_' . static::class . '_homedir_create_' . $i])) {
-				$remote = new \LAM\REMOTE\Remote();
+				$remote = new Remote();
 				try {
 					$remote->connect($remoteServer);
 				}
@@ -1713,14 +1714,13 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				// remote command results
 				if (!empty($result)) {
 					$singleresult = explode(",", $result);
-					if (is_array($singleresult)
-						&& (($singleresult[0] == 'ERROR') || ($singleresult[0] == 'WARN') || ($singleresult[0] == 'INFO'))) {
+					if (($singleresult[0] == 'ERROR') || ($singleresult[0] == 'WARN') || ($singleresult[0] == 'INFO')) {
 						$return[] = $singleresult;
 					}
 				}
 			}
 			elseif (isset($_POST['form_subpage_' . static::class . '_homedir_delete_' . $i])) {
-				$remote = new \LAM\REMOTE\Remote();
+				$remote = new Remote();
 				try {
 					$remote->connect($remoteServer);
 				}
@@ -1743,8 +1743,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				// remote command results
 				if (!empty($result)) {
 					$singleresult = explode(",", $result);
-					if (is_array($singleresult)
-						&& (($singleresult[0] == 'ERROR') || ($singleresult[0] == 'WARN') || ($singleresult[0] == 'INFO'))) {
+					if (($singleresult[0] == 'ERROR') || ($singleresult[0] == 'WARN') || ($singleresult[0] == 'INFO')) {
 						$return[] = $singleresult;
 					}
 				}
@@ -1773,13 +1772,13 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				$year[] = $i;
 			}
 			// display name
-			$return->add(new htmlResponsiveInputField(_('Display name'), 'sambaSamAccount_displayName', '', 'displayName'), 12);
+			$return->add(new htmlResponsiveInputField(_('Display name'), 'sambaSamAccount_displayName', '', 'displayName'));
 			// use no password at all
-			$return->add(new htmlResponsiveInputCheckbox('sambaSamAccount_sambaAcctFlagsN', false, _('Use no password'), 'noPassword'), 12);
+			$return->add(new htmlResponsiveInputCheckbox('sambaSamAccount_sambaAcctFlagsN', false, _('Use no password'), 'noPassword'));
 			// account deactivation
-			$return->add(new htmlResponsiveInputCheckbox('sambaSamAccount_sambaAcctFlagsD', false, _('Account is deactivated'), 'deactivated'), 12);
+			$return->add(new htmlResponsiveInputCheckbox('sambaSamAccount_sambaAcctFlagsD', false, _('Account is deactivated'), 'deactivated'));
 			// password never expires
-			$return->add(new htmlResponsiveInputCheckbox('sambaSamAccount_sambaAcctFlagsX', false, _('Password does not expire'), 'noExpire'), 12);
+			$return->add(new htmlResponsiveInputCheckbox('sambaSamAccount_sambaAcctFlagsX', false, _('Password does not expire'), 'noExpire'));
 			// expiration date
 			$return->addLabel(new htmlOutputText(_('Account expiration date')));
 			$expireContainer = new htmlResponsiveRow();
@@ -1794,23 +1793,23 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				for ($i = 90; $i > 67; $i--) {
 					$drives[] = chr($i) . ':';
 				}
-				$return->add(new htmlResponsiveSelect('sambaSamAccount_sambaHomeDrive', $drives, ['-'], _('Home drive'), 'homeDrive'), 12);
+				$return->add(new htmlResponsiveSelect('sambaSamAccount_sambaHomeDrive', $drives, ['-'], _('Home drive'), 'homeDrive'));
 			}
 			if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideHomePath')) {
 				// path to home directory
-				$return->add(new htmlResponsiveInputField(_('Home path'), 'sambaSamAccount_smbhome', '', 'homePath'), 12);
+				$return->add(new htmlResponsiveInputField(_('Home path'), 'sambaSamAccount_smbhome', '', 'homePath'));
 			}
 			if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideProfilePath')) {
 				// profile path
-				$return->add(new htmlResponsiveInputField(_('Profile path'), 'sambaSamAccount_profilePath', '', 'profilePath'), 12);
+				$return->add(new htmlResponsiveInputField(_('Profile path'), 'sambaSamAccount_profilePath', '', 'profilePath'));
 			}
 			if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideLogonScript')) {
 				// logon script
-				$return->add(new htmlResponsiveInputField(_('Logon script'), 'sambaSamAccount_logonScript', '', 'scriptPath'), 12);
+				$return->add(new htmlResponsiveInputField(_('Logon script'), 'sambaSamAccount_logonScript', '', 'scriptPath'));
 			}
 			if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideWorkstations')) {
 				// allowed workstations
-				$return->add(new htmlResponsiveInputField(_('Samba workstations'), 'sambaSamAccount_userWorkstations', '', 'workstations'), 12);
+				$return->add(new htmlResponsiveInputField(_('Samba workstations'), 'sambaSamAccount_userWorkstations', '', 'workstations'));
 			}
 			// domains
 			$sambaDomains = $this->getDomains();
@@ -1818,7 +1817,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			for ($i = 0; $i < count($sambaDomains); $i++) {
 				$sambaDomainNames[] = $sambaDomains[$i]->name;
 			}
-			$return->add(new htmlResponsiveSelect('sambaSamAccount_sambaDomainName', $sambaDomainNames, null, _('Domain'), 'domain'), 12);
+			$return->add(new htmlResponsiveSelect('sambaSamAccount_sambaDomainName', $sambaDomainNames, null, _('Domain'), 'domain'));
 			// Windows group
 			$groups = [];
 			foreach ($this->groupRids as $key => $value) {
@@ -1827,10 +1826,10 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			$groups["-"] = "-";
 			$groupSelect = new htmlResponsiveSelect('sambaSamAccount_group', $groups, ['513'], _('Windows group'), 'group');
 			$groupSelect->setHasDescriptiveElements(true);
-			$return->add($groupSelect, 12);
+			$return->add($groupSelect);
 			if (!$this->isBooleanConfigOptionSet('sambaSamAccount_hideLogonHours')) {
 				// logon hours
-				$return->add(new htmlResponsiveInputField(_('Logon hours'), 'sambaSamAccount_logonHours', '', 'logonHoursUpload'), 12);
+				$return->add(new htmlResponsiveInputField(_('Logon hours'), 'sambaSamAccount_logonHours', '', 'logonHoursUpload'));
 			}
 		}
 		elseif ($this->get_scope() == 'host') {
@@ -1840,7 +1839,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			for ($i = 0; $i < count($sambaDomains); $i++) {
 				$sambaDomainNames[] = $sambaDomains[$i]->name;
 			}
-			$return->add(new htmlResponsiveSelect('sambaSamAccount_sambaDomainName', $sambaDomainNames, null, _('Domain'), 'domain'), 12);
+			$return->add(new htmlResponsiveSelect('sambaSamAccount_sambaDomainName', $sambaDomainNames, null, _('Domain'), 'domain'));
 		}
 		return $return;
 	}
@@ -1964,13 +1963,13 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		];
 		$historySelect = new htmlResponsiveSelect('sambaSamAccount_history', $historyOptions, ['yes_deleteLast'], _("Password history"), 'history');
 		$historySelect->setHasDescriptiveElements(true);
-		$configContainer->add($historySelect, 12);
+		$configContainer->add($historySelect);
 		// hidden options
 		$configContainer->addVerticalSpacer('1rem');
 		$configHiddenLabelGroup = new htmlGroup();
 		$configHiddenLabelGroup->addElement(new htmlOutputText(_('Hidden options') . ' '));
 		$configHiddenLabelGroup->addElement(new htmlHelpLink('hiddenOptions'));
-		$configContainer->add($configHiddenLabelGroup, 12);
+		$configContainer->add($configHiddenLabelGroup);
 		$configContainer->addVerticalSpacer('0.5rem');
 		$configContainer->add(new htmlResponsiveInputCheckbox('sambaSamAccount_hideHomeDrive', false, _('Home drive'), null, true), 12, 4);
 		$configContainer->add(new htmlResponsiveInputCheckbox('sambaSamAccount_hideHomePath', false, _('Home path'), null, true), 12, 4);
@@ -2099,7 +2098,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				$partialAccounts[$i]['sambaPwdLastSet'] = time();
 				if (!get_preg($rawAccounts[$i][$ids['sambaSamAccount_password']], 'password')) {
 					$errMsg = $this->messages['sambaNTPassword'][2];
-					array_push($errMsg, [$i]);
+					$errMsg[] = [$i];
 					$errors[] = $errMsg;
 				}
 				// use Unix password
@@ -2116,7 +2115,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				}
 				else {
 					$errMsg = $this->messages['pwdUnix'][0];
-					array_push($errMsg, [$i]);
+					$errMsg[] = [$i];
 					$errors[] = $errMsg;
 				}
 				// use no password
@@ -2128,7 +2127,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['noPassword'][0];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2144,7 +2143,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['noExpire'][0];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2157,7 +2156,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['deactivated'][0];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2184,7 +2183,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['expireDate'][0];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2195,7 +2194,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['homeDrive'][0];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2225,7 +2224,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				}
 				else {
 					$errMsg = $this->messages['domain'][0];
-					array_push($errMsg, [$i]);
+					$errMsg[] = [$i];
 					$errors[] = $errMsg;
 				}
 				// group
@@ -2246,7 +2245,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['group'][0];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2264,7 +2263,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['rid'][2];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2298,7 +2297,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 				}
 				else {
 					$errMsg = $this->messages['domain'][0];
-					array_push($errMsg, [$i]);
+					$errMsg[] = [$i];
 					$errors[] = $errMsg;
 				}
 				// RID
@@ -2308,7 +2307,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 					}
 					else {
 						$errMsg = $this->messages['rid'][3];
-						array_push($errMsg, [$i]);
+						$errMsg[] = [$i];
 						$errors[] = $errMsg;
 					}
 				}
@@ -2334,7 +2333,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		$selfServiceContainer = new htmlResponsiveRow();
 		// domain suffix
 		$selfServiceDomainSuffix = new htmlResponsiveInputField(_('Domain suffix'), 'sambaSamAccount_domainSuffix', null, ['domainSuffix', static::class]);
-		$selfServiceContainer->add($selfServiceDomainSuffix, 12);
+		$selfServiceContainer->add($selfServiceDomainSuffix);
 		// password history
 		$historyOptions = [
 			_('yes - ordered ascending') => 'yes_deleteLast',
@@ -2343,7 +2342,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		];
 		$historySelect = new htmlResponsiveSelect('sambaSamAccount_history', $historyOptions, ['yes_deleteLast'], _("Password history"), ['history', static::class]);
 		$historySelect->setHasDescriptiveElements(true);
-		$selfServiceContainer->add($historySelect, 12);
+		$selfServiceContainer->add($historySelect);
 		return $selfServiceContainer;
 	}
 
@@ -2376,7 +2375,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			$pwd2->setSameValueFieldID('sambaSamAccount_password');
 			$group->addElement($pwd2);
 			$row = new htmlResponsiveRow();
-			$row->add($group, 12);
+			$row->add($group);
 			$return['password'] = $row;
 		}
 		if (in_array('sambaPwdLastSet', $fields)) {
@@ -2544,9 +2543,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 	 *
 	 */
 	public function managesPasswordAttributes() {
-		if ($this->get_scope() == "user") {
-			return true;
-		}
+		return ($this->get_scope() === "user");
 	}
 
 	/**
@@ -2622,7 +2619,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 	 * @param String $password new password
 	 */
 	public static function oldPasswordUsed($password, $attributes, $sambaDomain) {
-		$attributes = array_change_key_case($attributes, CASE_LOWER);
+		$attributes = array_change_key_case($attributes);
 		if (empty($attributes['sambapasswordhistory'][0]) || ($sambaDomain == null)
 			|| !is_numeric($sambaDomain->pwdHistoryLength) || ($sambaDomain->pwdHistoryLength < 1)) {
 			return false;
@@ -2644,7 +2641,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 	 * @return samba3domain domain
 	 */
 	public function getUserDomain($attributes, $server = null, $suffix = null) {
-		$attributes = array_change_key_case($attributes, CASE_LOWER);
+		$attributes = array_change_key_case($attributes);
 		$sambaDomains = $this->getDomains($server, $suffix);
 		if (sizeof($sambaDomains) > 0) {
 			$domainSID = null;
@@ -2834,7 +2831,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		if (!isset($attributes['sambaacctflags'][0])) {
 			return false;
 		}
-		return strpos($attributes['sambaacctflags'][0], 'L') !== false;
+		return str_contains($attributes['sambaacctflags'][0], 'L');
 	}
 
 	/**
@@ -2850,7 +2847,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 		if (!isset($attributes['sambaacctflags'][0])) {
 			return false;
 		}
-		return strpos($attributes['sambaacctflags'][0], 'D') !== false;
+		return str_contains($attributes['sambaacctflags'][0], 'D');
 	}
 
 	/**
@@ -2868,7 +2865,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 			}
 		}
 		$flags = $attributes['sambaacctflags'][0];
-		if (strpos($flags, 'D') === false) {
+		if (!str_contains($flags, 'D')) {
 			$flags[strpos($flags, ' ')] = 'D';
 		}
 		$attributes['sambaacctflags'][0] = $flags;
@@ -2964,8 +2961,8 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 	public function getPasswordQuickChangeOptions(): array {
 		$options = [];
 		if ((isset($this->attributes['sambaacctflags'][0])
-			&& ((strpos($this->attributes['sambaacctflags'][0], 'L') !== false)
-				|| (strpos($this->attributes['sambaacctflags'][0], 'D') !== false)))) {
+			&& ((str_contains($this->attributes['sambaacctflags'][0], 'L'))
+				|| (str_contains($this->attributes['sambaacctflags'][0], 'D'))))) {
 			$options[] = new PasswordQuickChangeOption('unlockAccountSamba', _('Unlock Samba account'));
 		}
 		if (in_array_ignore_case('sambaSamAccount', $this->attributes['objectClass'])) {
@@ -2984,8 +2981,8 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 	public function getPasswordQuickChangeChanges(string $password): array {
 		$attrs = [];
 		if (isset($_POST['unlockAccountSamba']) && isset($this->attributes['sambaacctflags'][0])) {
-			if ((strpos($this->attributes['sambaacctflags'][0], 'L') !== false)
-				|| (strpos($this->attributes['sambaacctflags'][0], 'D') !== false)) {
+			if ((str_contains($this->attributes['sambaacctflags'][0], 'L'))
+				|| (str_contains($this->attributes['sambaacctflags'][0], 'D'))) {
 				$sambaFlags = $this->attributes['sambaacctflags'][0];
 				$sambaFlags = str_replace('L', ' ', $sambaFlags);
 				$sambaFlags = str_replace('D', ' ', $sambaFlags);
@@ -3027,10 +3024,7 @@ class sambaSamAccount extends baseModule implements passwordService, AccountStat
 	 * @inheritDoc
 	 */
 	public function getPasswordQuickChangePasswordStrengthUserName(): ?string {
-		if (isset($this->attributes['uid'][0])) {
-			return $this->attributes['uid'][0];
-		}
-		return null;
+		return $this->attributes['uid'][0] ?? null;
 	}
 
 	/**
diff --git a/lam/lib/modules/sambaSamAccount/sambaMungedDial.inc b/lam/lib/modules/sambaSamAccount/sambaMungedDial.inc
index f47602a9c..d607d953c 100644
--- a/lam/lib/modules/sambaSamAccount/sambaMungedDial.inc
+++ b/lam/lib/modules/sambaSamAccount/sambaMungedDial.inc
@@ -2,6 +2,7 @@
 /*
   This code is part of GOsa (https://gosa.gonicus.de)
   Copyright (C) 2004  Cajus Pollmeier
+                2024  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -20,591 +21,575 @@
 
 
 /**
-* Manages terminal server settings for Samba 3.
-*
-* @package modules
-* @author Cajus Pollmeier
-*/
+ * Manages terminal server settings for Samba 3.
+ *
+ * @package modules
+ * @author Cajus Pollmeier
+ */
 
 /**
  * File header
  */
-define ("SAMBA_MUNGEDDIAL_FILEHEADER",
-        "20002000200020002000200020002000".
-        "20002000200020002000200020002000".
-        "20002000200020002000200020002000".
-        "20002000200020002000200020002000".
-        "20002000200020002000200020002000".
-        "20002000200020002000200020002000".
-      	"5000");
+const SAMBA_MUNGEDDIAL_FILEHEADER = "20002000200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"5000";
 /**
  * File header for old format.
  */
-define ("SAMBA_MUNGEDDIAL_FILEHEADER_OLD",   
-        "6d000800200020002000200020002000".
-        "20002000200020002000200020002000".
-        "20002000200020002000200064000100".
-        "20002000200020002000200020002000".
-        "20002000200020002000200020002000".
-        "20002000200020002000200020002000".
-        "50001000");
+const SAMBA_MUNGEDDIAL_FILEHEADER_OLD = "6d000800200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"20002000200020002000200064000100" .
+	"20002000200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"20002000200020002000200020002000" .
+	"50001000";
+
 /**
-* Manages terminal server settings for Samba 3.
-*
-* @author Cajus Pollmeier
-* @package modules
-*/
-class sambaMungedDial
-{
-  /* Terminal server variables (samba3) */
-  public $ctx= array(
-  	'CtxCfgPresent' =>	        	'551e0bb0',
-	  'CtxCfgFlags1' =>	          	'00e00010',
-  	'CtxCallback' =>	          	'',
-  	'CtxShadow' =>	          		'01000000',
-  	'CtxMaxConnectionTime' =>   	'',
-  	'CtxMaxDisconnectionTime' =>	'',
-  	'CtxMaxIdleTime' => 	      	'',
-  	'CtxKeyboardLayout' =>	     	'',
-  	'CtxMinEncryptionLevel' =>  	'00',
-  	'CtxWorkDirectory' =>	      	'',
-  	'CtxNWLogonServer' =>	      	'',  
-  	'CtxWFHomeDir' =>	           	'',
-  	'CtxWFHomeDirDrive' =>	    	'',
-  	'CtxWFProfilePath' =>	      	'',
-  	'CtxInitialProgram' =>	     	'',
-  	'CtxCallbackNumber' =>	    	'');
-
-  /* attribute list for save action */
-  public $ctxattributes= array("CtxCfgPresent", "CtxCfgFlags1", "CtxCallback",
-        "CtxShadow", "CtxMaxConnectionTime", "CtxMaxDisconnectionTime",
-        "CtxMaxIdleTime", "CtxKeyboardLayout", "CtxMinEncryptionLevel",
-        "CtxWorkDirectory", "CtxNWLogonServer", "CtxWFHomeDir",
-        "CtxWFHomeDirDrive", "CtxWFProfilePath", "CtxInitialProgram",
-        "CtxCallbackNumber");	
-
-  /* These parameters are treated as strings and get a trailing zero */
-  private $stringParams= array( "CtxWorkDirectory", "CtxNWLogonServer", 
-			"CtxWFHomeDir", "CtxWFHomeDirDrive", 
-			"CtxWFProfilePath", "CtxInitialProgram", "CtxCallbackNumber");
-
-  /* These parameters are treated as time values and get converted */
-  private $timeParams= array("CtxMaxConnectionTime", "CtxMaxDisconnectionTime", "CtxMaxIdleTime");
-
-  private $old_behavior= false;
-
-  /** strhex */
-  function strhex($string)
-  {
-  	$hex="";
-
-  	for ($i=0; $i<strlen($string); $i++) {
-  		$hex.= dechex(ord($string[$i]));
-    }
-	
-  	return ($hex);
-  }
-
-  /** hexstr */
-  function hexstr($hex)
-  {
-  	$string="";
-
-  	for ($i=0; $i<strlen($hex)-1; $i+=2) {
-  		$string.= chr(hexdec($hex[$i].$hex[$i+1]));
-  	}
-  
-  	return ($string);
-  }
-
-  /** endian */
-  function endian($src)
-  {
-  	return (substr($src, 2, 2).substr($src, 0, 2));
-  }
-
-  /** genTime */
-  function genTime ($minutes)
-  {
-  	if ($minutes === '') {
-  		$minutes = 0;
-	}
-  	$usec= (int) ($minutes * 60 * 1000);
-  	$src=  sprintf('%04x%04x', $usec & 0x0FFFF, ($usec & 0x0FFFF0000) >> 16);
-  	return (sambaMungedDial::endian(substr($src, 0, 4)).sambaMungedDial::endian(substr($src, 4, 4)));
-  }
-
-  /** readTime */
-  function readTime ($time)
-  {
-  	$lo= substr($time, 0, 4);
-  	$hi= substr($time, 4, 4);
-  
-  	$usecs= (hexdec(substr($lo, 2, 2)) * 256 + hexdec(substr($lo, 0, 2))) +
-  		(hexdec(substr($hi, 2 ,2)) * 256 + hexdec(substr($hi, 0, 2))) * 256 * 256;
-  
-  	return ((int)($usecs / (60 * 1000)));
-  }
-
-  /** to8bit */
-  function to8bit($string)
-  {
-  	$result= "";
-  
-  	/* Strip zeros */
-  	for ($i= 0; $i<strlen($string); $i++){
-  		if ($string[$i] != chr(0)){
-  			$result.= $string[$i];
-  		}
-  	}
-  
-  	return ($result);
-  }
-
-  /** Checks if this is a valid Samba path. */
-  function is_samba_path($path)
-  {
-  	if ($path == ""){
-  		return (TRUE);
-  	}
-
-  	if (!preg_match('/^[a-z0-9%\\\\_.:+-\\\\$]+$/i', $path)){
-  		return (FALSE);
-  	}
-  
-  	return preg_match ("/\\\\.+$/", $path);
-  }
-
-  /** Encode full MungedDial-String */
-  function encode_munged ($params)
-  {
-  	/* Walk through the parameters and convert them */
-  	$result= sambaMungedDial::hexstr(SAMBA_MUNGEDDIAL_FILEHEADER);
-  
-  	// CHANGED: We need to insert the number of attributes right after SAMBA_MUNGEDDIAL_FILEHEADER.
-  	$counter= 0;
-  	$result_tmp= "";
-  	foreach ($params as $paramName => $paramValue) {
-  		/* String parameter? */
-  		if (in_array($paramName, $this->stringParams)){
-  			$isString= TRUE;
-  			$paramValue= sambaMungedDial::strhex($paramValue.chr(0).chr(0));
-  		} else {
-  			$isString= FALSE;
-  		}
-  
-  		/* Time parameter? */
-  		if (in_array($paramName, $this->timeParams)){
-  			$paramValue= sambaMungedDial::genTime($paramValue);
-  		}
-  
-  		$result_tmp.= sambaMungedDial::munge($paramName, $paramValue, $isString);
-  		$counter++;
-  	}
-  	
-  	// First add the number of attributes
-  	$result.= sambaMungedDial::hexstr(sprintf("%02x00", $counter));
-  
-  	// Then the usual stuff
-  	$result.= $result_tmp;
-  
-  	return ($result);
-  }
-
-  /** Setup parameter given by paramName to MungedDial-Format */
-  function munge($paramName, $paramValue, $isString) 
-  {
-  	$result= "";
-  	
-  	/* Encode paramName to UTF-16 */
-          if (function_exists("recode")){
-                  $utfName= recode("ISO8859-15..UTF-16", $paramName);
-          } else {
-                  $utfName= iconv("ISO8859-15", "UTF-16BE", $paramName);
-          }
-  
-  	/* Set parameter length, high and low byte */
-  	$paramLen= strlen($utfName);
-  	$result.= chr($paramLen & 0x0FF);
-  	$result.= chr(($paramLen & 0x0FF00) >> 8);
-  
-  	/* String parameters have additional trailing bytes */
-  	$valueLen= strlen($paramValue);
-  	$result.= chr($valueLen & 0x0FF);
-  	$result.= chr(($valueLen & 0x0FF00) >> 8);
-  	
-  	/* Length fields have a trailing '01' appended by the UTF-16 converted name */
-  	$result.= chr(1);
-  	$result.= $utfName;
-  
-  	/* Parameter is padded with '00' */
-  	$result.= chr(0);
-  	$result.= $paramValue;
-  
-  	/* Append a trailing '00' to string parameters */
-  	if ($isString && (strlen($paramValue) & 1)){
-  		$result.= chr(0);
-  	}
-  	
-  	return ($result);
-  }
-
-  /** Takes a base64-encoded MungedDial-String and returns an array of included parameters and values */
-  function decode_munged($munge)
-  {
-  	$result= [];
-  		
-  	/* 
-  	 * Remove base64 encoding and skip SAMBA_MUNGEDDIAL_FILEHEADER.
-  	 * The '4' is added, because the SAMBA_MUNGEDDIAL_FILEHEADER has been stripped by 4 chars.
-  	 * This is the number of attributes following - we don't need this at read time, only when writing.
-  	 */
-    if(substr(base64_decode($munge),0,2)=="6d") {
-      $this->old_behavior=true;
-    }
-
-    if($this->old_behavior) {
-  	  $ctxField= substr(base64_decode($munge), (strlen(SAMBA_MUNGEDDIAL_FILEHEADER_OLD)) / 2);
-    } else {
-  	  $ctxField= substr(base64_decode($munge), (strlen(SAMBA_MUNGEDDIAL_FILEHEADER)+4) / 2);
-    }
-  
-  	/* Decode parameters */
-  	while ($ctxField!=""){
-  
-  		/* Read value lengths */
-  		$ctxParmNameLength= ord($ctxField[0]) + 16 * ord($ctxField[1]);
-  		$ctxParmLength= ord($ctxField[2]) + 16 * ord($ctxField[3]);
-  				
-  		/* Reposition ctxField on start of parameter name, read parameter name */
-  		$ctxField= substr($ctxField, 6);
-  		$ctxParmName= sambaMungedDial::to8bit(substr($ctxField, 0, $ctxParmNameLength));
-  				
-  		/* Reposition ctxField on start of parameter */
-  		$ctxField= substr($ctxField, $ctxParmNameLength);
-  		$ctxParm= substr($ctxField, 0, $ctxParmLength);
-  				
-  		/* If string parameter, convert */
-  		if (in_array($ctxParmName, $this->stringParams)){
-  				$ctxParm= sambaMungedDial::hexstr($ctxParm);
-  		}
-  		/* If time parameter, convert */
-  		if (in_array($ctxParmName, $this->timeParams)){
-  			$ctxParm= sambaMungedDial::readTime($ctxParm);
-  		}
-  
-  		/* Assign in result array */
-  		$result[$ctxParmName]= trim($ctxParm);
-  				
-  		/* Reposition ctxField on end of parameter and continue */
-  		$ctxField= substr($ctxField, $ctxParmLength);
-  	}
-  
-  	return ($result);
-  }
-
-  /** function takes a base64-encoded sambaMungedDial */
-  function load ($mungedDial)
-  {
-  	$this->ctx= $this->decode_munged($mungedDial);
-  }
-
-  /** Returns ready-to-run mungedDialString to be filled into ldap */
-  function getMunged ()
-  {
-  	// Do extra check for valid timeParams (they must be set to 0 if disabled)
-  	foreach($this->timeParams as $value) {
-	  	if(!isset($this->ctx[$value])) {
-	  		$this->ctx[$value]= 0;
-	  	}
-  	}
-  	return base64_encode($this->encode_munged($this->ctx));
-  }
-
-  /** Returns array of flags, which can be set on-demand with activated java-script */
-  function getOnDemandFlags ()
-  {
-  	$result= [];
-	foreach ($this->timeParams as $value) {
-		$result[$value."Mode"]= "";
-	}
-	$result['CtxInitialProgramMode'] = "";
-  	return $result;
-  }
-
-  /** Gets Terminal-Server-Login value: enabled/disabled */
-  function getTsLogin ()
-  {
-   	$flags= ord(substr($this->ctx['CtxCfgFlags1'], 5, 1));
-    	
-  	if ($flags & 1) {
-    		$result= false;
-    	} else {
-  	  	$result= true;
-    }
-  
-  	return $result;
-  }
-
-  /** Sets Terminal-Server-Login value: enabled/disabled */
-  function setTsLogin ($checked)
-  {
-  	$flag= substr($this->ctx['CtxCfgFlags1'], 5, 1);
-  	
-  	if ($checked) {
-   		$flag|= 1;
-  	} else {
-   		$flag&= 0xFE;
-  	}
-  	
-  	$this->ctx['CtxCfgFlags1'][5]= sprintf('%1x', $flag);
-  }
-
-  /** gets Broken-Connection value: disconnect/reset */
-  function getBrokenConn ()
-  {
-  	$flags= ord(substr($this->ctx['CtxCfgFlags1'], 5, 1));
-  	if ($flags & 4) {
-  		$result= "1";
-  	} else {
-  		$result= "0";
-  	}
-  	
-  	return $result;
-  }
-
-  /** sets Broken-Connection value: disconnect/reset */
-  function setBrokenConn ($checked) 
-  {
-  	$flag= substr($this->ctx['CtxCfgFlags1'], 5, 1);
-  	
-  	if ($checked) {
-  		$flag|= 4;
-  	} else {
-  		$flag&= 0xFB;
-  	}
-  	
-  	$this->ctx['CtxCfgFlags1'][5]= sprintf('%1x', $flag);
-  }
-
-  /** gets Reconnection value: from any client/from previous client only */
-  function getReConn ()
-  {
-  	$flags= ord(substr($this->ctx['CtxCfgFlags1'], 5, 1));
-  	if ($flags & 2) {
-  		$result= "1";
-  	} else {
-  		$result= "0";	
-  	}
-  	
-  	return $result;
-  }
-
-  /** sets Reconnection value: from any client/from previous client only */
-  function setReConn ($checked)
-  {
-  	$flag= substr($this->ctx['CtxCfgFlags1'], 5, 1);
-  	
-  	if ($checked) {
-  		$flag|= 2;
-  	} else {
-  		$flag&= 0xFD;
-  	}
-  	
-  	$this->ctx['CtxCfgFlags1'][5]= sprintf('%1x', $flag);
-  }
-
-  /** gets Inherit-config-from-client value: enabled/disabled */
-  function getInheritMode ()
-  {
-  	if (substr($this->ctx['CtxCfgFlags1'], 6, 1) == "1") {
-  		$result= true;
-  	} else {
-  		$result= false;
-  	}
-  
-  	return $result;
-  }
-
-  /** sets Inherit-config-from-client value: enabled/disabled */
-  function setInheritMode ($checked)
-  {
-  	if ($checked) {
-  		$this->ctx['CtxCfgFlags1'][6]= "1";
-  	} else {
-  		$this->ctx['CtxCfgFlags1'][6]= "0";
-  	}
-  }
-
-  /** gets shadow value (enum): 0-4
-	0: disabled
-	1: input on, notify on
-	2: input on, notify off
-	3: input off, notify on
-	4: input off, notify off 
-  */
-  function getShadow ()
-  {
-    if($this->old_behavior) {
-      $result= substr($this->ctx['CtxCfgFlags1'], 1, 1);
-    } else {
-    	$result= substr($this->ctx['CtxShadow'], 1, 1);
-    }
-  	return $result;
-  }
-
-  /** sets shadow value */
-  function setShadow ($checked, $value)
-  {
-  	if ($checked) {
-      if($this->old_behavior) {
-        // We need to reset the old setting
-       	$this->ctx['CtxCfgFlags1'][1]= sprintf('%1X', $value);
-      }
-  		$this->ctx['CtxShadow'][1]= sprintf('%1x', $value);
-  	}
-  }
-
-  /** gets connect-client-drive-at-logon value: enabled/disabled */
-  function getConnectClientDrives ()
-  {
-  	$connections= hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
-  	if ($connections & 8) {
-  		$result= true;
-  	} else {
-  		$result= false;
-  	}
-  
-  	return $result;
-  }
-
-  /** sets connect-client-drive-at-logon value: enabled/disabled */
-  function setConnectClientDrives ($checked)
-  {
-  	$flag= hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
-  	if ($checked) {
-  		$flag|= 8;
-  	} else {
-  		$flag&= 0xF7;
-  	}
-  
-  	$this->ctx['CtxCfgFlags1'][2]= sprintf('%1x', $flag);
-  }
-
-  /** gets connect-client-printers-at-logon value: enabled/disabled */
-  function getConnectClientPrinters ()
-  {
-  	$connections= hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
-  	if ($connections & 4) {
-  		$result= true;
-  	} else {
-  		$result= false;
-  	}
-  	
-  	return $result;
-  }
-
-  /** sets connect-client-printers-at-logon value: enabled/disabled */
-  function setConnectClientPrinters ($checked)
-  {
-  	$flag= hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
-  	
-  	if ($checked) {
-  		$flag|= 4;
-  	} else {
-  		$flag&= 0xFB;
-  	}
-  	
-  	$this->ctx['CtxCfgFlags1'][2]= sprintf('%1x', $flag);
-  }
-
-  /** gets set-client-printer-to-default value: enabled/disabled */
-  function getDefaultPrinter ()
-  {
-  	$connections= hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
-  	if ($connections & 2) {
-  		$result= true;
-  	} else {
-  		$result= false;
-  	}
-  
-  	return $result;
-  }
-
-  /** sets set-client-printer-to-default value: enabled/disabled */
-  function setDefaultPrinter ($checked)
-  {
-  	$flag= hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
-  	
-  	if ($checked) {
-  		$flag|= 2;
-  	} else {
-  		$flag&= 0xFD;
-  	}
-  	
-  	$this->ctx['CtxCfgFlags1'][2]= sprintf('%1x', $flag);
-  }
-
-  /** SMARTY: gets the checkbox state of "Connection" */
-  function getCtxMaxConnectionTimeF ()
-  {
-  	// Connection Time is 0 if disabled
-  	if (isset($this->ctx['CtxMaxConnectionTime']) && ($this->ctx['CtxMaxConnectionTime'] != 0)) {
-  		$result= true;
-  	} else {
-  		$result= false;
-  	}
-  
-  	return $result;
-  }
-
-  /** SMARTY: sets the checkbox "Connection" to unchecked */
-  function setCtxMaxConnectionTimeF ($checked)
-  {
-  	if ($checked) {
-  		unset ($this->ctx['CtxMaxConnectionTime']);
-  	}
-  }
-
-  /** SMARTY: gets the checkbox state of "Disconnection" */
-  function getCtxMaxDisconnectionTimeF ()
-  {
-  	// Connection Time is 0 if disabled
-  	if (isset($this->ctx['CtxMaxDisconnectionTime']) && ($this->ctx['CtxMaxDisconnectionTime'] != 0)) {
-  		$result= true;
-  	} else {
-  		$result= false;
-  	}
-
-  	return $result;
-  }
-
-  /** SMARTY: sets the checkbox "Disconnection" to unchecked */
-  function setCtxMaxDisconnectionTimeF ($checked)
-  {
-  	if ($checked) {
-  		unset ($this->ctx['CtxMaxDisconnectionTime']);
-  	} 
-  }
-
-  /** SMARTY: gets the checkbox state of "Idle" */
-  function getCtxMaxIdleTimeF ()
-  {
-  	// Connection Time is 0 if disabled
-  	if (isset($this->ctx['CtxMaxIdleTime']) && ($this->ctx['CtxMaxIdleTime'] != 0)) {
-  		$result= true;
-  	} else {
-  		$result= false;
-  	}
-  
-  	return $result;
-  }
-
-  /** SMARTY: sets the checkbox "Idle" to unchecked */
-  function setCtxMaxIdleTimeF ($checked)
-  {
-  	if ($checked) {
-  		unset ($this->ctx['CtxMaxIdleTime']);
-  	}
-  }
+ * Manages terminal server settings for Samba 3.
+ *
+ * @author Cajus Pollmeier
+ * @package modules
+ */
+class sambaMungedDial {
+	/* Terminal server variables (samba3) */
+	public $ctx = [
+		'CtxCfgPresent' => '551e0bb0',
+		'CtxCfgFlags1' => '00e00010',
+		'CtxCallback' => '',
+		'CtxShadow' => '01000000',
+		'CtxMaxConnectionTime' => '',
+		'CtxMaxDisconnectionTime' => '',
+		'CtxMaxIdleTime' => '',
+		'CtxKeyboardLayout' => '',
+		'CtxMinEncryptionLevel' => '00',
+		'CtxWorkDirectory' => '',
+		'CtxNWLogonServer' => '',
+		'CtxWFHomeDir' => '',
+		'CtxWFHomeDirDrive' => '',
+		'CtxWFProfilePath' => '',
+		'CtxInitialProgram' => '',
+		'CtxCallbackNumber' => ''];
+
+	/* attribute list for save action */
+	public $ctxattributes = ["CtxCfgPresent", "CtxCfgFlags1", "CtxCallback",
+		"CtxShadow", "CtxMaxConnectionTime", "CtxMaxDisconnectionTime",
+		"CtxMaxIdleTime", "CtxKeyboardLayout", "CtxMinEncryptionLevel",
+		"CtxWorkDirectory", "CtxNWLogonServer", "CtxWFHomeDir",
+		"CtxWFHomeDirDrive", "CtxWFProfilePath", "CtxInitialProgram",
+		"CtxCallbackNumber"];
+
+	/* These parameters are treated as strings and get a trailing zero */
+	private $stringParams = ["CtxWorkDirectory", "CtxNWLogonServer",
+		"CtxWFHomeDir", "CtxWFHomeDirDrive",
+		"CtxWFProfilePath", "CtxInitialProgram", "CtxCallbackNumber"];
+
+	/* These parameters are treated as time values and get converted */
+	private $timeParams = ["CtxMaxConnectionTime", "CtxMaxDisconnectionTime", "CtxMaxIdleTime"];
+
+	private $old_behavior = false;
+
+	/** strhex */
+	function strhex($string) {
+		$hex = "";
+
+		for ($i = 0; $i < strlen($string); $i++) {
+			$hex .= dechex(ord($string[$i]));
+		}
+
+		return ($hex);
+	}
+
+	/** hexstr */
+	function hexstr($hex) {
+		$string = "";
+
+		for ($i = 0; $i < strlen($hex) - 1; $i += 2) {
+			$string .= chr(hexdec($hex[$i] . $hex[$i + 1]));
+		}
+
+		return ($string);
+	}
+
+	/** endian */
+	function endian($src) {
+		return (substr($src, 2, 2) . substr($src, 0, 2));
+	}
+
+	/** genTime */
+	function genTime($minutes) {
+		if ($minutes === '') {
+			$minutes = 0;
+		}
+		$usec = (int) ($minutes * 60 * 1000);
+		$src = sprintf('%04x%04x', $usec & 0x0FFFF, ($usec & 0x0FFFF0000) >> 16);
+		return (sambaMungedDial::endian(substr($src, 0, 4)) . sambaMungedDial::endian(substr($src, 4, 4)));
+	}
+
+	/** readTime */
+	function readTime($time) {
+		$lo = substr($time, 0, 4);
+		$hi = substr($time, 4, 4);
+
+		$usecs = (hexdec(substr($lo, 2, 2)) * 256 + hexdec(substr($lo, 0, 2))) +
+			(hexdec(substr($hi, 2, 2)) * 256 + hexdec(substr($hi, 0, 2))) * 256 * 256;
+
+		return ((int) ($usecs / (60 * 1000)));
+	}
+
+	/** to8bit */
+	function to8bit($string) {
+		$result = "";
+
+		/* Strip zeros */
+		for ($i = 0; $i < strlen($string); $i++) {
+			if ($string[$i] != chr(0)) {
+				$result .= $string[$i];
+			}
+		}
+
+		return ($result);
+	}
+
+	/** Checks if this is a valid Samba path. */
+	function is_samba_path($path) {
+		if ($path == "") {
+			return (TRUE);
+		}
+
+		if (!preg_match('/^[a-z0-9%\\\\_.:+-\\\\$]+$/i', $path)) {
+			return (FALSE);
+		}
+
+		return preg_match("/\\\\.+$/", $path);
+	}
+
+	/** Encode full MungedDial-String */
+	function encode_munged($params) {
+		/* Walk through the parameters and convert them */
+		$result = sambaMungedDial::hexstr(SAMBA_MUNGEDDIAL_FILEHEADER);
+
+		// CHANGED: We need to insert the number of attributes right after SAMBA_MUNGEDDIAL_FILEHEADER.
+		$counter = 0;
+		$result_tmp = "";
+		foreach ($params as $paramName => $paramValue) {
+			/* String parameter? */
+			if (in_array($paramName, $this->stringParams)) {
+				$isString = TRUE;
+				$paramValue = sambaMungedDial::strhex($paramValue . chr(0) . chr(0));
+			}
+			else {
+				$isString = FALSE;
+			}
+
+			/* Time parameter? */
+			if (in_array($paramName, $this->timeParams)) {
+				$paramValue = sambaMungedDial::genTime($paramValue);
+			}
+
+			$result_tmp .= sambaMungedDial::munge($paramName, $paramValue, $isString);
+			$counter++;
+		}
+
+		// First add the number of attributes
+		$result .= sambaMungedDial::hexstr(sprintf("%02x00", $counter));
+
+		// Then the usual stuff
+		$result .= $result_tmp;
+
+		return ($result);
+	}
+
+	/** Setup parameter given by paramName to MungedDial-Format */
+	function munge($paramName, $paramValue, $isString) {
+		$result = "";
+
+		/* Encode paramName to UTF-16 */
+		if (function_exists("recode")) {
+			$utfName = recode("ISO8859-15..UTF-16", $paramName);
+		}
+		else {
+			$utfName = iconv("ISO8859-15", "UTF-16BE", $paramName);
+		}
+
+		/* Set parameter length, high and low byte */
+		$paramLen = strlen($utfName);
+		$result .= chr($paramLen & 0x0FF);
+		$result .= chr(($paramLen & 0x0FF00) >> 8);
+
+		/* String parameters have additional trailing bytes */
+		$valueLen = strlen($paramValue);
+		$result .= chr($valueLen & 0x0FF);
+		$result .= chr(($valueLen & 0x0FF00) >> 8);
+
+		/* Length fields have a trailing '01' appended by the UTF-16 converted name */
+		$result .= chr(1);
+		$result .= $utfName;
+
+		/* Parameter is padded with '00' */
+		$result .= chr(0);
+		$result .= $paramValue;
+
+		/* Append a trailing '00' to string parameters */
+		if ($isString && (strlen($paramValue) & 1)) {
+			$result .= chr(0);
+		}
+
+		return ($result);
+	}
+
+	/** Takes a base64-encoded MungedDial-String and returns an array of included parameters and values */
+	function decode_munged($munge) {
+		$result = [];
+
+		/*
+		 * Remove base64 encoding and skip SAMBA_MUNGEDDIAL_FILEHEADER.
+		 * The '4' is added, because the SAMBA_MUNGEDDIAL_FILEHEADER has been stripped by 4 chars.
+		 * This is the number of attributes following - we don't need this at read time, only when writing.
+		 */
+		if (str_starts_with(base64_decode($munge), "6d")) {
+			$this->old_behavior = true;
+		}
+
+		if ($this->old_behavior) {
+			$ctxField = substr(base64_decode($munge), (strlen(SAMBA_MUNGEDDIAL_FILEHEADER_OLD)) / 2);
+		}
+		else {
+			$ctxField = substr(base64_decode($munge), (strlen(SAMBA_MUNGEDDIAL_FILEHEADER) + 4) / 2);
+		}
+
+		/* Decode parameters */
+		while ($ctxField != "") {
+
+			/* Read value lengths */
+			$ctxParmNameLength = ord($ctxField[0]) + 16 * ord($ctxField[1]);
+			$ctxParmLength = ord($ctxField[2]) + 16 * ord($ctxField[3]);
+
+			/* Reposition ctxField on start of parameter name, read parameter name */
+			$ctxField = substr($ctxField, 6);
+			$ctxParmName = sambaMungedDial::to8bit(substr($ctxField, 0, $ctxParmNameLength));
+
+			/* Reposition ctxField on start of parameter */
+			$ctxField = substr($ctxField, $ctxParmNameLength);
+			$ctxParm = substr($ctxField, 0, $ctxParmLength);
+
+			/* If string parameter, convert */
+			if (in_array($ctxParmName, $this->stringParams)) {
+				$ctxParm = sambaMungedDial::hexstr($ctxParm);
+			}
+			/* If time parameter, convert */
+			if (in_array($ctxParmName, $this->timeParams)) {
+				$ctxParm = sambaMungedDial::readTime($ctxParm);
+			}
+
+			/* Assign in result array */
+			$result[$ctxParmName] = trim($ctxParm);
+
+			/* Reposition ctxField on end of parameter and continue */
+			$ctxField = substr($ctxField, $ctxParmLength);
+		}
+
+		return ($result);
+	}
+
+	/** function takes a base64-encoded sambaMungedDial */
+	function load($mungedDial) {
+		$this->ctx = $this->decode_munged($mungedDial);
+	}
+
+	/** Returns ready-to-run mungedDialString to be filled into ldap */
+	function getMunged() {
+		// Do extra check for valid timeParams (they must be set to 0 if disabled)
+		foreach ($this->timeParams as $value) {
+			if (!isset($this->ctx[$value])) {
+				$this->ctx[$value] = 0;
+			}
+		}
+		return base64_encode($this->encode_munged($this->ctx));
+	}
+
+	/** Returns array of flags, which can be set on-demand with activated java-script */
+	function getOnDemandFlags() {
+		$result = [];
+		foreach ($this->timeParams as $value) {
+			$result[$value . "Mode"] = "";
+		}
+		$result['CtxInitialProgramMode'] = "";
+		return $result;
+	}
+
+	/** Gets Terminal-Server-Login value: enabled/disabled */
+	function getTsLogin() {
+		$flags = ord(substr($this->ctx['CtxCfgFlags1'], 5, 1));
+
+		if ($flags & 1) {
+			$result = false;
+		}
+		else {
+			$result = true;
+		}
+
+		return $result;
+	}
+
+	/** Sets Terminal-Server-Login value: enabled/disabled */
+	function setTsLogin($checked) {
+		$flag = substr($this->ctx['CtxCfgFlags1'], 5, 1);
+
+		if ($checked) {
+			$flag |= 1;
+		}
+		else {
+			$flag &= 0xFE;
+		}
+
+		$this->ctx['CtxCfgFlags1'][5] = sprintf('%1x', $flag);
+	}
+
+	/** gets Broken-Connection value: disconnect/reset */
+	function getBrokenConn() {
+		$flags = ord(substr($this->ctx['CtxCfgFlags1'], 5, 1));
+		if ($flags & 4) {
+			$result = "1";
+		}
+		else {
+			$result = "0";
+		}
+
+		return $result;
+	}
+
+	/** sets Broken-Connection value: disconnect/reset */
+	function setBrokenConn($checked) {
+		$flag = substr($this->ctx['CtxCfgFlags1'], 5, 1);
+
+		if ($checked) {
+			$flag |= 4;
+		}
+		else {
+			$flag &= 0xFB;
+		}
+
+		$this->ctx['CtxCfgFlags1'][5] = sprintf('%1x', $flag);
+	}
+
+	/** gets Reconnection value: from any client/from previous client only */
+	function getReConn() {
+		$flags = ord(substr($this->ctx['CtxCfgFlags1'], 5, 1));
+		if ($flags & 2) {
+			$result = "1";
+		}
+		else {
+			$result = "0";
+		}
+
+		return $result;
+	}
+
+	/** sets Reconnection value: from any client/from previous client only */
+	function setReConn($checked) {
+		$flag = substr($this->ctx['CtxCfgFlags1'], 5, 1);
+
+		if ($checked) {
+			$flag |= 2;
+		}
+		else {
+			$flag &= 0xFD;
+		}
+
+		$this->ctx['CtxCfgFlags1'][5] = sprintf('%1x', $flag);
+	}
+
+	/** gets Inherit-config-from-client value: enabled/disabled */
+	function getInheritMode() {
+		if (substr($this->ctx['CtxCfgFlags1'], 6, 1) == "1") {
+			$result = true;
+		}
+		else {
+			$result = false;
+		}
+
+		return $result;
+	}
+
+	/** sets Inherit-config-from-client value: enabled/disabled */
+	function setInheritMode($checked) {
+		if ($checked) {
+			$this->ctx['CtxCfgFlags1'][6] = "1";
+		}
+		else {
+			$this->ctx['CtxCfgFlags1'][6] = "0";
+		}
+	}
+
+	/** gets shadow value (enum): 0-4
+	 * 0: disabled
+	 * 1: input on, notify on
+	 * 2: input on, notify off
+	 * 3: input off, notify on
+	 * 4: input off, notify off
+	 */
+	function getShadow() {
+		if ($this->old_behavior) {
+			$result = substr($this->ctx['CtxCfgFlags1'], 1, 1);
+		}
+		else {
+			$result = substr($this->ctx['CtxShadow'], 1, 1);
+		}
+		return $result;
+	}
+
+	/** sets shadow value */
+	function setShadow($checked, $value) {
+		if ($checked) {
+			if ($this->old_behavior) {
+				// We need to reset the old setting
+				$this->ctx['CtxCfgFlags1'][1] = sprintf('%1X', $value);
+			}
+			$this->ctx['CtxShadow'][1] = sprintf('%1x', $value);
+		}
+	}
+
+	/** gets connect-client-drive-at-logon value: enabled/disabled */
+	function getConnectClientDrives() {
+		$connections = hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
+		if ($connections & 8) {
+			$result = true;
+		}
+		else {
+			$result = false;
+		}
+
+		return $result;
+	}
+
+	/** sets connect-client-drive-at-logon value: enabled/disabled */
+	function setConnectClientDrives($checked) {
+		$flag = hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
+		if ($checked) {
+			$flag |= 8;
+		}
+		else {
+			$flag &= 0xF7;
+		}
+
+		$this->ctx['CtxCfgFlags1'][2] = sprintf('%1x', $flag);
+	}
+
+	/** gets connect-client-printers-at-logon value: enabled/disabled */
+	function getConnectClientPrinters() {
+		$connections = hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
+		if ($connections & 4) {
+			$result = true;
+		}
+		else {
+			$result = false;
+		}
+
+		return $result;
+	}
+
+	/** sets connect-client-printers-at-logon value: enabled/disabled */
+	function setConnectClientPrinters($checked) {
+		$flag = hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
+
+		if ($checked) {
+			$flag |= 4;
+		}
+		else {
+			$flag &= 0xFB;
+		}
+
+		$this->ctx['CtxCfgFlags1'][2] = sprintf('%1x', $flag);
+	}
+
+	/** gets set-client-printer-to-default value: enabled/disabled */
+	function getDefaultPrinter() {
+		$connections = hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
+		if ($connections & 2) {
+			$result = true;
+		}
+		else {
+			$result = false;
+		}
+
+		return $result;
+	}
+
+	/** sets set-client-printer-to-default value: enabled/disabled */
+	function setDefaultPrinter($checked) {
+		$flag = hexdec(substr($this->ctx['CtxCfgFlags1'], 2, 1));
+
+		if ($checked) {
+			$flag |= 2;
+		}
+		else {
+			$flag &= 0xFD;
+		}
+
+		$this->ctx['CtxCfgFlags1'][2] = sprintf('%1x', $flag);
+	}
+
+	/** SMARTY: gets the checkbox state of "Connection" */
+	function getCtxMaxConnectionTimeF() {
+		// Connection Time is 0 if disabled
+		if (isset($this->ctx['CtxMaxConnectionTime']) && ($this->ctx['CtxMaxConnectionTime'] != 0)) {
+			$result = true;
+		}
+		else {
+			$result = false;
+		}
+
+		return $result;
+	}
+
+	/** SMARTY: sets the checkbox "Connection" to unchecked */
+	function setCtxMaxConnectionTimeF($checked) {
+		if ($checked) {
+			unset ($this->ctx['CtxMaxConnectionTime']);
+		}
+	}
+
+	/** SMARTY: gets the checkbox state of "Disconnection" */
+	function getCtxMaxDisconnectionTimeF() {
+		// Connection Time is 0 if disabled
+		if (isset($this->ctx['CtxMaxDisconnectionTime']) && ($this->ctx['CtxMaxDisconnectionTime'] != 0)) {
+			$result = true;
+		}
+		else {
+			$result = false;
+		}
+
+		return $result;
+	}
+
+	/** SMARTY: sets the checkbox "Disconnection" to unchecked */
+	function setCtxMaxDisconnectionTimeF($checked) {
+		if ($checked) {
+			unset ($this->ctx['CtxMaxDisconnectionTime']);
+		}
+	}
+
+	/** SMARTY: gets the checkbox state of "Idle" */
+	function getCtxMaxIdleTimeF() {
+		// Connection Time is 0 if disabled
+		if (isset($this->ctx['CtxMaxIdleTime']) && ($this->ctx['CtxMaxIdleTime'] != 0)) {
+			$result = true;
+		}
+		else {
+			$result = false;
+		}
+
+		return $result;
+	}
+
+	/** SMARTY: sets the checkbox "Idle" to unchecked */
+	function setCtxMaxIdleTimeF($checked) {
+		if ($checked) {
+			unset ($this->ctx['CtxMaxIdleTime']);
+		}
+	}
 }
diff --git a/lam/lib/modules/shadowAccount.inc b/lam/lib/modules/shadowAccount.inc
index b710afa6c..612c759cb 100644
--- a/lam/lib/modules/shadowAccount.inc
+++ b/lam/lib/modules/shadowAccount.inc
@@ -49,12 +49,12 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 	/**
 	 * ID for expired account status.
 	 */
-	const STATUS_ACCOUNT_EXPIRED = "SHADOW_ACCOUNT_EXPIRED";
+	private const STATUS_ACCOUNT_EXPIRED = "SHADOW_ACCOUNT_EXPIRED";
 
 	/**
 	 * ID for expired password status.
 	 */
-	const STATUS_PASSWORD_EXPIRED = "SHADOW_PASSWORD_EXPIRED";
+	private const STATUS_PASSWORD_EXPIRED = "SHADOW_PASSWORD_EXPIRED";
 
 	/**
 	 * Creates a new shadowAccount object.
@@ -92,7 +92,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 	 * @return boolean true if module fits
 	 */
 	public function can_manage() {
-		return in_array($this->get_scope(), ['user']);
+		return $this->get_scope() === 'user';
 	}
 
 	/**
@@ -130,23 +130,23 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 		}
 		$profileOptionsTable = new htmlResponsiveRow();
 		// auto add extension
-		$profileOptionsTable->add(new htmlResponsiveInputCheckbox('shadowAccount_addExt', false, _('Automatically add this extension'), 'autoAdd'), 12);
+		$profileOptionsTable->add(new htmlResponsiveInputCheckbox('shadowAccount_addExt', false, _('Automatically add this extension'), 'autoAdd'));
 		// password warning
 		$profilePwdWarning = new htmlResponsiveInputField(_('Password warning'), 'shadowAccount_shadowWarning', null, 'shadowwarning');
 		$profilePwdWarning->setFieldMaxLength(4);
-		$profileOptionsTable->add($profilePwdWarning, 12);
+		$profileOptionsTable->add($profilePwdWarning);
 		// password expiration
 		$profilePwdExpiration = new htmlResponsiveInputField(_('Password expiration'), 'shadowAccount_shadowInactive', null, 'shadowinactive');
 		$profilePwdExpiration->setFieldMaxLength(4);
-		$profileOptionsTable->add($profilePwdExpiration, 12);
+		$profileOptionsTable->add($profilePwdExpiration);
 		// minimum password age
 		$profilePwdMinAge = new htmlResponsiveInputField(_('Minimum password age'), 'shadowAccount_shadowMin', null, 'shadowmin');
 		$profilePwdMinAge->setFieldMaxLength(5);
-		$profileOptionsTable->add($profilePwdMinAge, 12);
+		$profileOptionsTable->add($profilePwdMinAge);
 		// maximum password age
 		$profilePwdMinAge = new htmlResponsiveInputField(_('Maximum password age'), 'shadowAccount_shadowMax', null, 'shadowmax');
 		$profilePwdMinAge->setFieldMaxLength(5);
-		$profileOptionsTable->add($profilePwdMinAge, 12);
+		$profileOptionsTable->add($profilePwdMinAge);
 		// expiration date
 		$profileOptionsTable->addLabel(new htmlOutputText(_('Account expiration date')));
 		$profileOptionsExpire = new htmlResponsiveRow();
@@ -399,7 +399,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 			$expireTable = new htmlGroup();
 			$expireTable->addElement(new htmlOutputText($expirationDate, false));
 			$expireTable->addElement(new htmlAccountPageButton('shadowAccount', 'expire', 'open', 'edit-document.svg', true, _('Change')));
-			$expireTable->addElement(new htmlHelpLink('shadowexpire'), true);
+			$expireTable->addElement(new htmlHelpLink('shadowexpire'));
 			$return->addField($expireTable);
 
 			$pwdChangeDate = "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
@@ -415,7 +415,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 			if (isset($this->attributes['shadowmax'][0]) && ($this->attributes['shadowmax'][0] != '')) {
 				$pwdChangeTable->addElement(new htmlAccountPageButton('shadowAccount', 'attributes', 'expirePassword', _('Force password change')));
 			}
-			$pwdChangeTable->addElement(new htmlHelpLink('shadowlastchange'), true);
+			$pwdChangeTable->addElement(new htmlHelpLink('shadowlastchange'));
 			$return->addField($pwdChangeTable);
 
 			$return->addVerticalSpacer('2rem');
@@ -424,7 +424,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 			$return->add($remButton, 12, 12, 12, 'text-center');
 		}
 		else {
-			$return->add(new htmlAccountPageButton('shadowAccount', 'attributes', 'addObjectClass', _('Add Shadow account extension')), 12);
+			$return->add(new htmlAccountPageButton('shadowAccount', 'attributes', 'addObjectClass', _('Add Shadow account extension')));
 		}
 		return $return;
 	}
@@ -508,19 +508,19 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 		$dateField->showCalendar('d.m.Y');
 		$return->add($dateField);
 		if ($this->getAccountContainer()->getAccountModule('sambaSamAccount') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncSamba', false, _('Set also for Samba 3')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncSamba', false, _('Set also for Samba 3')));
 		}
 		if ($this->getAccountContainer()->getAccountModule('windowsUser') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncWindows', false, _('Set also for Windows')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncWindows', false, _('Set also for Windows')));
 		}
 		if ($this->getAccountContainer()->getAccountModule('heimdalKerberos') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncHeimdal', false, _('Set also for Kerberos')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncHeimdal', false, _('Set also for Kerberos')));
 		}
 		if ($this->getAccountContainer()->getAccountModule('mitKerberos') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncMIT', false, _('Set also for Kerberos')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncMIT', false, _('Set also for Kerberos')));
 		}
 		if ($this->getAccountContainer()->getAccountModule('mitKerberosStructural') != null) {
-			$return->add(new htmlResponsiveInputCheckbox('syncMITStructural', false, _('Set also for Kerberos')), 12);
+			$return->add(new htmlResponsiveInputCheckbox('syncMITStructural', false, _('Set also for Kerberos')));
 		}
 		$return->addVerticalSpacer('2rem');
 		$buttonTable = new htmlGroup();
@@ -638,7 +638,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 				(($rawAccounts[$i][$ids['shadowAccount_minAge']] == '') || ($rawAccounts[$i][$ids['shadowAccount_maxAge']] == '') ||   // and one is not set
 					($rawAccounts[$i][$ids['shadowAccount_minAge']] > $rawAccounts[$i][$ids['shadowAccount_maxAge']]))) {  // or minAge > maxAge
 				$errMsg = $this->messages['shadow_cmp'][1];
-				array_push($errMsg, [$i]);
+				$errMsg[] = [$i];
 				$messages[] = $errMsg;
 			}
 			// expiration date
@@ -650,7 +650,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 				}
 				else {
 					$errMsg = $this->messages['shadow_expireDate'][0];
-					array_push($errMsg, [$i]);
+					$errMsg[] = [$i];
 					$messages[] = $errMsg;
 				}
 			}
@@ -663,7 +663,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 				}
 				else {
 					$errMsg = $this->messages['shadow_lastChange'][0];
-					array_push($errMsg, [$i]);
+					$errMsg[] = [$i];
 					$messages[] = $errMsg;
 				}
 			}
@@ -864,7 +864,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 			return false;
 		}
 		if (($attrs['shadowlastchange'][0] < 1) || ($attrs['shadowmax'][0] < 1)) {
-			return;
+			return false;
 		}
 		$time = new DateTime('@' . $attrs['shadowlastchange'][0] * 24 * 3600, new DateTimeZone('UTC'));
 		$time = $time->add(new DateInterval('P' . $attrs['shadowmax'][0] . 'D'));
@@ -1065,7 +1065,7 @@ class shadowAccount extends baseModule implements passwordService, AccountStatus
 
 if (interface_exists('\LAM\JOB\Job', false)) {
 
-	include_once dirname(__FILE__) . '/../passwordExpirationJob.inc';
+	include_once __DIR__ . '/../passwordExpirationJob.inc';
 
 	/**
 	 * Job to notify users about password expiration.