Admin tools updated to PHP8.4 and namespace

18 files changed, 478 insertions, 358 deletions

diff --git a/admin/admin_login_inc.php b/admin/admin_login_inc.php
index f472298..d0209df 100644..100755
--- a/admin/admin_login_inc.php
+++ b/admin/admin_login_inc.php
@@ -1,10 +1,14 @@
 <?php
+
+use Bitweaver\BitBase;
+use Bitweaver\Users\BaseAuth;
+use Bitweaver\Users\BitHybridAuthManager;
 // $Header$
 // Copyright (c) 2002-2003, Luis Argerich, Garland Foster, Eduardo Polidor, et. al.
 // All Rights Reserved. See below for details and a complete list of authors.
 // Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See http://www.gnu.org/copyleft/lesser.html for details.
 
-require_once( USERS_PKG_CLASS_PATH.'BaseAuth.php' );
+require_once USERS_PKG_CLASS_PATH.'BaseAuth.php';
 
 $loginSettings = array(
 	'users_allow_register' => array(
@@ -55,168 +59,178 @@ $loginSettings = array(
 );
 $gBitSmarty->assign( 'loginSettings', $loginSettings );
 
-$registerSettings = array(
-	'users_validate_user' => array(
+$registerSettings = [
+	'users_validate_user'                 => [
 		'label' => "Validate users by email",
-		'type' => "checkbox",
-		'note' => "Send an email to the user, to validate registration.",
-	),
-	'users_validate_email' => array(
+		'type'  => "checkbox",
+		'note'  => "Send an email to the user, to validate registration.",
+	],
+	'users_validate_email'                => [
 		'label' => "Validate email address",
-		'type' => "checkbox",
-		'link' => "kernel/admin/index.php?page=server/General Settings",
-		'note' => "This feature should be used only when you need the maximum security and should be used with discretion. If a visitor's email server is not responding, they will not be placed into the group specified below for verified emails. If a users email is determined to be invalid (meaning, the server does respond, but negatively) they will not be able to register. You also must have a valid sender email to use this feature.",
-	),
-	'users_case_sensitive_login' => array(
+		'type'  => "checkbox",
+		'link'  => "kernel/admin/index.php?page=server/General Settings",
+		'note'  => "This feature should be used only when you need the maximum security and should be used with discretion. If a visitor's email server is not responding, they will not be placed into the group specified below for verified emails. If a users email is determined to be invalid (meaning, the server does respond, but negatively) they will not be able to register. You also must have a valid sender email to use this feature.",
+	],
+	'users_case_sensitive_login'          => [
 		'label' => 'Case-Sensitive Login',
-		'type' => "checkbox",
-		'note' => 'This determines whether user login names are case-sensitive.'
-	),
-	'reg_real_name' => array(
+		'type'  => "checkbox",
+		'note'  => 'This determines whether user login names are case-sensitive.',
+	],
+	'reg_real_name'                       => [
 		'label' => "Real Name",
-		'type' => "checkbox",
-		'note' => "Allow users to supply their real name.",
-	),
-	'reg_country' => array(
+		'type'  => "checkbox",
+		'note'  => "Allow users to supply their real name.",
+	],
+	'reg_country'                         => [
 		'label' => "Country",
-		'type' => "checkbox",
-		'note' => "Allow users to pick country of residency.",
-	),
-	'reg_language' => array(
+		'type'  => "checkbox",
+		'note'  => "Allow users to pick country of residency.",
+	],
+	'reg_language'                        => [
 		'label' => "Language",
-		'type' => "checkbox",
-		'note' => "Allow users to select their preferred language.",
-	),
-	'reg_homepage' => array(
+		'type'  => "checkbox",
+		'note'  => "Allow users to select their preferred language.",
+	],
+	'reg_homepage'                        => [
 		'label' => "Homepage URL",
-		'type' => "checkbox",
-		'note' => "Allow users to enter the url to their own homepage.",
-	),
-	'reg_portrait' => array(
+		'type'  => "checkbox",
+		'note'  => "Allow users to enter the url to their own homepage.",
+	],
+	'reg_portrait'                        => [
 		'label' => "Profile Picture",
-		'type' => "checkbox",
-		'note' => "Allow users to upload a profile picture.",
-	),
-	'users_pass_due' => array(
+		'type'  => "checkbox",
+		'note'  => "Allow users to upload a profile picture.",
+	],
+	'users_pass_due'                      => [
 		'label' => "Password invalid after days",
-		'type' => "text",
-		'note' => "",
-	),
-	'users_pass_chr_num' => array(
+		'type'  => "text",
+		'note'  => "",
+	],
+	'users_pass_chr_num'                  => [
 		'label' => "Force to use characters <strong>and</strong> numbers in passwords",
-		'type' => "checkbox",
-		'note' => "",
-	),
-	'users_min_pass_length' => array(
+		'type'  => "checkbox",
+		'note'  => "",
+	],
+	'users_min_pass_length'               => [
 		'label' => "Minimum password length",
-		'type' => "text",
-		'note' => "",
-	),
-	'user_password_generator' => array(
+		'type'  => "text",
+		'note'  => "",
+	],
+	'user_password_generator'             => [
 		'label' => "Password generator",
-		'type' => "checkbox",
-		'note' => "Display password generator on registration page that creates secure passwords.",
-	),
-	'users_register_require_passcode' => array(
+		'type'  => "checkbox",
+		'note'  => "Display password generator on registration page that creates secure passwords.",
+	],
+	'users_register_require_passcode'     => [
 		'label' => "Request passcode to register",
-		'type' => "checkbox",
-		'note' => "",
-	),
-	'users_register_passcode' => array(
+		'type'  => "checkbox",
+		'note'  => "",
+	],
+	'users_register_passcode'             => [
 		'label' => "Passcode",
-		'type' => "text",
-		'note' => "Enter the Passcode that is required for users to register with your site.",
-	),
-	'users_random_number_reg' => array(
+		'type'  => "text",
+		'note'  => "Enter the Passcode that is required for users to register with your site.",
+	],
+	'users_random_number_reg'             => [
 		'label' => "Use basic captcha to prevent automatic/robot registration",
-		'type' => "checkbox",
-		'note' => "This will generate an image with a word that the user has to confirm during the registration step.",
-	),
-	'users_register_recaptcha' => array(
+		'type'  => "checkbox",
+		'note'  => "This will generate an image with a word that the user has to confirm during the registration step.",
+	],
+	'users_register_recaptcha'            => [
 		'label' => "Use advanced reCAPTCHA to prevent automatic/robot registration",
-		'type' => "checkbox",
-		'note' => "To use reCAPTCHA you must get your API keys from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a> and enter them below.",
-	),
-	'users_register_recaptcha_site_key' => array(
+		'type'  => "checkbox",
+		'note'  => "To use reCAPTCHA you must get your API keys from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a> and enter them below.",
+	],
+	'users_register_recaptcha_site_key'   => [
 		'label' => "reCAPTCHA Site Key",
-		'type' => "text",
-		'note' => "This will be given to you after registering your site with Google",
-	),
-	'users_register_recaptcha_secret_key' => array(
+		'type'  => "text",
+		'note'  => "This will be given to you after registering your site with Google",
+	],
+	'users_register_recaptcha_secret_key' => [
 		'label' => "reCAPTCHA Secret Key",
-		'type' => "text",
-		'note' => "This will be given to you after registering your site with Google",
-	),
-	'users_register_cfturnstile' => array(
-		'label' => "Use Cloudflare Turnstile to prevent automatic/robot registration",
-		'type' => "checkbox",
-		'note' => "To use Cloudflare Turnstile you must get your API keys from <a href='https://www.cloudflare.com/application-services/products/turnstile/'>https://www.solvemedia.com</a> and enter them below.",
-	),
-	'users_register_cfturnstile_site_key' => array(
-		'label' => "Cloudflare Site Key",
-		'type' => "text",
-		'note' => "This will be given to you after registering your site with Cloudflare",
-	),
-	'users_register_cfturnstile_secret_key' => array(
-		'label' => "Cloudflare Secret Key",
-		'type' => "text",
-		'note' => "This will be given to you after registering your site with Cloudflare",
-	),
-);
+		'type'  => "text",
+		'note'  => "This will be given to you after registering your site with Google",
+	],
+	'users_register_smcaptcha'            => [
+		'label' => "Use Solve Media CAPTCHA to prevent automatic/robot registration",
+		'type'  => "checkbox",
+		'note'  => "To use Solve Media CAPTCHA you must get your API keys from <a href='https://www.solvemedia.com'>https://www.solvemedia.com</a> and enter them below.",
+	],
+	'users_register_smcaptcha_c_key'      => [
+		'label' => "Solve Media Challenge Key (C-key)",
+		'type'  => "text",
+		'note'  => "This will be given to you after registering your site with Solve Media",
+	],
+	'users_register_smcaptcha_v_key'      => [
+		'label' => "Solve Media Verification Key (V-key)",
+		'type'  => "text",
+		'note'  => "This will be given to you after registering your site with Solve Media",
+	],
+	'users_register_smcaptcha_h_key'      => [
+		'label' => "Solve Media Authentication Hash Key (H-key)",
+		'type'  => "text",
+		'note'  => "This will be given to you after registering your site with Solve Media",
+	],
+];
 $gBitSmarty->assign( 'registerSettings', $registerSettings );
 
-$httpSettings = array(
-	'site_https_login' => array(
+$httpSettings = [
+	'site_https_login'          => [
 		'label' => "Allow secure (https) login",
-		'type' => "checkbox",
-		'note' => "",
-	),
-	'site_https_login_required' => array(
+		'type'  => "checkbox",
+		'note'  => "",
+	],
+	'site_https_login_required' => [
 		'label' => "Require secure (https) login",
-		'type' => "checkbox",
-		'note' => "",
-	),
-	'site_http_domain' => array(
+		'type'  => "checkbox",
+		'note'  => "",
+	],
+	'site_http_domain'          => [
 		'label' => "HTTP server name",
-		'type' => "text",
-		'note' => "",
-	),
-	'site_http_port' => array(
+		'type'  => "text",
+		'note'  => "",
+	],
+	'site_http_port'            => [
 		'label' => "HTTP port",
-		'type' => "text",
-		'note' => "",
-	),
-	'site_http_prefix' => array(
+		'type'  => "text",
+		'note'  => "",
+	],
+	'site_http_prefix'          => [
 		'label' => "HTTP URL prefix",
-		'type' => "text",
-		'note' => "",
-	),
-	'site_https_domain' => array(
+		'type'  => "text",
+		'note'  => "",
+	],
+	'site_https_domain'         => [
 		'label' => "HTTPS server name",
-		'type' => "text",
-		'note' => "",
-	),
-	'site_https_port' => array(
+		'type'  => "text",
+		'note'  => "",
+	],
+	'site_https_port'           => [
 		'label' => "HTTPS port",
-		'type' => "text",
-		'note' => "",
-	),
-	'site_https_prefix' => array(
+		'type'  => "text",
+		'note'  => "",
+	],
+	'site_https_prefix'         => [
 		'label' => "HTTPS URL prefix",
-		'type' => "text",
-		'note' => "",
-	),
-);
+		'type'  => "text",
+		'note'  => "",
+	],
+];
 $gBitSmarty->assign( 'httpSettings', $httpSettings );
 
-$listHash = array( 'sort_mode' => 'group_name_asc' );
-$gBitSmarty->assign('groups', $gBitUser->getAllGroups( $listHash ));
+
+if (defined ('ROLE_MODEL') ) {
+	$listHash = [ 'sort_mode' => 'role_name_asc' ];
+	$gBitSmarty->assign( 'roleList', $gBitUser->getAllRoles( $listHash ));
+} else {
+	$listHash = [ 'sort_mode' => 'group_name_asc' ];
+	$gBitSmarty->assign('groups', $gBitUser->getAllGroups( $listHash ));
+}
 
 if( !function_exists("gd_info" ) ) {
 	$gBitSmarty->assign( 'warning', 'PHP GD library is required for this feature (not found on your system)' );
 }
 
-require_once( USERS_PKG_CLASS_PATH.'BitHybridAuthManager.php' );
 BitHybridAuthManager::loadSingleton();
 global $gBitHybridAuthManager;
 
@@ -227,13 +241,13 @@ if( !empty( $_POST ) ) {
 		// make sure all (un)checkboxes stick
 		foreach( $allAuthProviders as $providerKey=>$providerConfig ) {
 			$enabledConfig = $gBitHybridAuthManager->getEnabledConfigKey( $providerConfig['provider'] );
-			$gBitSystem->storeConfig( $enabledConfig, BitBase::getParameter( $_REQUEST['hybridauth'], $enabledConfig, NULL ) );
+			$gBitSystem->storeConfig( $enabledConfig, BitBase::getParameter( $_REQUEST['hybridauth'], $enabledConfig, null ) );
 		}
 		foreach( $_REQUEST['hybridauth'] as $prefName=>$prefValue ) {
 			if( $prefName == 'users_ha_facebook_scope' ) {
 				$prefName = preg_replace('/\s+/', '', $prefName );
 			}
-			$gBitSystem->storeConfig( $prefName, (!empty( $prefValue ) ? $prefValue : NULL ) );
+			$gBitSystem->storeConfig( $prefName, !empty( $prefValue ) ? $prefValue : null );
 		}
 		$gBitHybridAuthManager->clearFromCache();
 	}
@@ -265,10 +279,13 @@ if( !empty( $_POST ) ) {
 	simple_set_value( 'users_validate_email_group', USERS_PKG_NAME );
 
 	if( isset( $_REQUEST['registration_group_choice'] ) ) {
-		$listHash = array();
-		$groupList = $gBitUser->getAllGroups( $listHash );
-		$in = array();
-		$out = array();
+		$listHash = [];
+		$groupList = ( defined( 'ROLE_MODEL' ) ) 
+			? $gBitUser->getAllRoles( $listHash ) 
+			: $gBitUser->getAllGroups( $listHash );
+		
+		$in = [];
+		$out = [];
 		foreach( $groupList as $gr ) {
 			if( $gr['group_id'] == ANONYMOUS_GROUP_ID ) {
 				continue;
@@ -285,7 +302,7 @@ if( !empty( $_POST ) ) {
 			$gBitUser->storeRegistrationChoice( $in, 'y' );
 		}
 		if( count( $out ) ) {
-			$gBitUser->storeRegistrationChoice( $out, NULL );
+			$gBitUser->storeRegistrationChoice( $out, null );
 		}
 	}
 	$gBitSystem->clearFromCache();
@@ -294,7 +311,7 @@ if( !empty( $_POST ) ) {
 $gBitSmarty->assign( 'hybridProviders', $gBitHybridAuthManager->getAllProviders() );
 
 
-$listHash = array();
+$listHash = [];
 
 // This needs to be made more generic so that it picks up all plugins
 // Could not see where the 'auth_ldap' was defined in the $options['avail'] array
@@ -311,4 +328,3 @@ if( !empty( $_REQUEST["auth_ldap"] ) ) {
 }
 
 $gBitSmarty->assign( 'authSettings', BaseAuth::getConfig() );
-?>
diff --git a/admin/admin_userfiles_inc.php b/admin/admin_userfiles_inc.php
index 7b0c7ae..06dce00 100644..100755
--- a/admin/admin_userfiles_inc.php
+++ b/admin/admin_userfiles_inc.php
@@ -11,5 +11,3 @@ if (isset($_REQUEST["userfilesprefs"])) {
 	$gBitSmarty->assign('uf_use_dir', $_REQUEST["uf_use_dir"]);
 	$gBitSmarty->assign('users_userfiles_quota', $_REQUEST['users_userfiles_quota']);
 }
-
-?>
diff --git a/admin/admin_users_inc.php b/admin/admin_users_inc.php
index 663a429..24793b3 100644..100755
--- a/admin/admin_users_inc.php
+++ b/admin/admin_users_inc.php
@@ -35,8 +35,8 @@ if( isset( $_REQUEST['settings'] ) ) {
 	}
 	$gBitSystem->storeConfig( 'custom_user_fields', $customFields, USERS_PKG_NAME );
 	$gBitSystem->storeConfig( 'users_display_name', (isset( $_REQUEST['settings']['users_display_name'] ) ? $_REQUEST['settings']['users_display_name'] : 'real_name'), USERS_PKG_NAME );
-	$gBitSystem->storeConfig( 'users_themes', (isset( $_REQUEST['settings']['users_themes'][0] ) ? $_REQUEST['settings']['users_themes'][0] : NULL), USERS_PKG_NAME );
-	$gBitSystem->storeConfig( 'users_layouts', (isset( $_REQUEST['settings']['users_layouts'][0] ) ? $_REQUEST['settings']['users_layouts'][0] : NULL), USERS_PKG_NAME );
+	$gBitSystem->storeConfig( 'users_themes', (isset( $_REQUEST['settings']['users_themes'][0] ) ? $_REQUEST['settings']['users_themes'][0] : null), USERS_PKG_NAME );
+	$gBitSystem->storeConfig( 'users_layouts', (isset( $_REQUEST['settings']['users_layouts'][0] ) ? $_REQUEST['settings']['users_layouts'][0] : null), USERS_PKG_NAME );
 }
 
 ?>
diff --git a/admin/assign_role_user.php b/admin/assign_role_user.php
index 2351976..4178a65 100644..100755
--- a/admin/assign_role_user.php
+++ b/admin/assign_role_user.php
@@ -15,7 +15,7 @@ if (!$gBitUser->userExists( array( 'user_id' => $_REQUEST["assign_user"] ) ) ) {
 }
 
 $assignUser = new RolePermUser( $_REQUEST["assign_user"] );
-$assignUser->load( TRUE );
+$assignUser->load( true );
 
 if( $assignUser->isAdmin() && !$gBitUser->isAdmin() ) {
 	$gBitSystem->fatalError( tra( 'You cannot modify a system administrator.' ));
@@ -34,7 +34,7 @@ if( isset( $_REQUEST["action"] ) ) {
 	$assignUser->storeUserDefaultRole( $assignUser->mUserId, $_REQUEST['default_role'] );
 	$assignUser->load();
 }
-$gBitSmarty->assignByRef( 'assignUser', $assignUser );
+$gBitSmarty->assign( 'assignUser', $assignUser );
 
 $listHash = array( 'sort_mode' => 'role_name_asc' );
 $gBitSmarty->assign('roles', $gBitUser->getAllRoles( $listHash ));
@@ -42,5 +42,5 @@ $gBitSmarty->assign('roles', $gBitUser->getAllRoles( $listHash ));
 $gBitSystem->setBrowserTitle( 'Edit User: '.$assignUser->mUsername );
 
 // Display the template
-$gBitSystem->display( 'bitpackage:users/admin_assign_role_user.tpl', NULL, array( 'display_mode' => 'admin' ));
+$gBitSystem->display( 'bitpackage:users/admin_assign_role_user.tpl', null, array( 'display_mode' => 'admin' ));
 ?>
diff --git a/admin/assign_user.php b/admin/assign_user.php
index e090a14..73044fc 100644..100755
--- a/admin/assign_user.php
+++ b/admin/assign_user.php
@@ -15,8 +15,8 @@ if (!$gBitUser->userExists( array( 'user_id' => $_REQUEST["assign_user"] ) ) ) {
 }
 
 $assignUser = new BitPermUser( $_REQUEST["assign_user"] );
-$assignUser->setCacheableObject( FALSE );
-$assignUser->load( TRUE );
+$assignUser->setCacheableObject( false );
+$assignUser->load( true );
 
 if( $assignUser->isAdmin() && !$gBitUser->isAdmin() ) {
 	$gBitSystem->fatalError( tra( 'You cannot modify a system administrator.' ));
@@ -36,7 +36,7 @@ if( isset( $_REQUEST["action"] ) ) {
 	$assignUser->storeUserDefaultGroup( $assignUser->mUserId, $_REQUEST['default_group'] );
 	$assignUser->load();
 }
-$gBitSmarty->assignByRef( 'assignUser', $assignUser );
+$gBitSmarty->assign( 'assignUser', $assignUser );
 
 $listHash = array( 'sort_mode' => 'group_name_asc' );
 $gBitSmarty->assign('groups', $gBitUser->getAllGroups( $listHash ));
@@ -50,5 +50,5 @@ if($gBitSystem->isPackageActive("quota")) {
 
 
 // Display the template
-$gBitSystem->display( 'bitpackage:users/admin_assign_user.tpl', NULL, array( 'display_mode' => 'admin' ));
+$gBitSystem->display( 'bitpackage:users/admin_assign_user.tpl', null, array( 'display_mode' => 'admin' ));
 ?>
diff --git a/admin/edit_group.php b/admin/edit_group.php
index a631a13..5adaf6d 100644..100755
--- a/admin/edit_group.php
+++ b/admin/edit_group.php
@@ -9,8 +9,8 @@ require_once( '../../kernel/includes/setup_inc.php' );
 // PERMISSIONS: NEEDS admin
 $gBitSystem->verifyPermission( 'p_users_admin' );
 
-$successMsg = NULL;
-$errorMsg = NULL;
+$successMsg = null;
+$errorMsg = null;
 
 if( count( $_GET ) > 2 || count( $_POST ) > 2 ) {
 	$gBitUser->verifyTicket();
@@ -18,8 +18,8 @@ if( count( $_GET ) > 2 || count( $_POST ) > 2 ) {
 
 if( !empty( $_REQUEST['group_id'] ) ) {
 	$permListHash = array(
-		'sort_mode' => !empty( $_REQUEST['sort_mode'] ) ? $_REQUEST['sort_mode'] : NULL,
-		'package' => !empty( $_REQUEST['package'] ) ? $_REQUEST['package'] : NULL,
+		'sort_mode' => !empty( $_REQUEST['sort_mode'] ) ? $_REQUEST['sort_mode'] : null,
+		'package' => !empty( $_REQUEST['package'] ) ? $_REQUEST['package'] : null,
 	);
 	$allPerms = $gBitUser->getGroupPermissions( $permListHash );
 }
@@ -42,9 +42,9 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 	}
 } elseif( isset($_REQUEST["members"] ) ) {
 	$groupInfo = $gBitUser->getGroupInfo( $_REQUEST["members"] );
-	$gBitSmarty->assignByRef( 'groupInfo', $groupInfo );
+	$gBitSmarty->assign( 'groupInfo', $groupInfo );
 	$groupMembers = $gBitUser->getGroupUsers( $_REQUEST["members"] );
-	$gBitSmarty->assignByRef( 'groupMembers', $groupMembers );
+	$gBitSmarty->assign( 'groupMembers', $groupMembers );
 	$mid = "bitpackage:users/group_list_members.tpl";
 	$gBitSystem->setBrowserTitle( tra( 'Group Members' ).': '.$groupInfo['group_name'] );
 } elseif( isset($_REQUEST["save"] ) ) {
@@ -63,7 +63,7 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 		$gBitSystem->storeConfig( 'default_home_group', $_REQUEST['group_id'], USERS_PKG_NAME );
 	} elseif( $_REQUEST['group_id'] == $gBitSystem->getConfig( 'default_home_group' ) ) {
 		// the default home group was unchecked.
-		$gBitSystem->storeConfig( 'default_home_group', NULL, USERS_PKG_NAME );
+		$gBitSystem->storeConfig( 'default_home_group', null, USERS_PKG_NAME );
 	}
 } elseif( isset( $_REQUEST['delete'] ) ) {
 	// Process a form to remove a group
@@ -73,7 +73,7 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 	if( isset( $_REQUEST["confirm"] ) ) {
 		$gBitUser->verifyTicket();
 		if( $_REQUEST['group_id'] == $gBitSystem->getConfig( 'default_home_group' ) ) {
-			$gBitSystem->storeConfig( 'default_home_group', NULL, USERS_PKG_NAME );
+			$gBitSystem->storeConfig( 'default_home_group', null, USERS_PKG_NAME );
 		}
 		$gBitUser->expungeGroup( $_REQUEST['group_id'] );
 		$successMsg = "The group ".$groupInfo['group_name']." was deleted.";
@@ -113,7 +113,7 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 
 if( !empty( $_REQUEST['group_id'] ) || (!empty( $_REQUEST["action"] ) && $_REQUEST["action"] == 'create' ) ) {
 	$permPackages = $gBitUser->getPermissionPackages();
-	$gBitSmarty->assignByRef( 'permPackages', $permPackages );
+	$gBitSmarty->assign( 'permPackages', $permPackages );
 
 	// get grouplist separately from the $users stuff to avoid splitting of data due to pagination
 	$listHash = array( 'sort_mode' => 'group_name_asc' );
@@ -138,15 +138,15 @@ if( !empty( $_REQUEST['group_id'] ) || (!empty( $_REQUEST["action"] ) && $_REQUE
 }
 $gBitSmarty->assign('groupList', $gBitUser->getAllGroups( $listHash ));
 
-$inc = array();
+$inc = [];
 if( empty( $mid ) ) {
 	if( !empty( $_REQUEST['group_id'] ) ) {
 		$groupInfo = $gBitUser->getGroupInfo( $_REQUEST['group_id'] );
 
 		$defaultGroupId = $gBitSystem->getConfig( 'default_home_group' );
-		$gBitSmarty->assignByRef( 'defaultGroupId', $defaultGroupId );
-		$gBitSmarty->assignByRef( 'groupInfo', $groupInfo );
-		$gBitSmarty->assignByRef( 'allPerms', $allPerms );
+		$gBitSmarty->assign( 'defaultGroupId', $defaultGroupId );
+		$gBitSmarty->assign( 'groupInfo', $groupInfo );
+		$gBitSmarty->assign( 'allPerms', $allPerms );
 
 		$gBitSystem->setBrowserTitle( tra( 'Admininster Group' ).': '.$groupInfo['group_name'] );
 		$mid = 'bitpackage:users/admin_group_edit.tpl';
@@ -161,5 +161,5 @@ $gBitSmarty->assign('successMsg',$successMsg);
 $gBitSmarty->assign('errorMsg',$errorMsg);
 
 // Display the template for group administration
-$gBitSystem->display( $mid , NULL, array( 'display_mode' => 'edit' ));
+$gBitSystem->display( $mid , null, array( 'display_mode' => 'edit' ));
 ?>
diff --git a/admin/edit_role.php b/admin/edit_role.php
index e48f3e2..15e4fbf 100644..100755
--- a/admin/edit_role.php
+++ b/admin/edit_role.php
@@ -1,52 +1,54 @@
 <?php
+
+use Bitweaver\KernelTools;
 // $Header$
 // Copyright (c) 2002-2003, Luis Argerich, Garland Foster, Eduardo Polidor, et. al.
 // All Rights Reserved. See below for details and a complete list of authors.
 // Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See http://www.gnu.org/copyleft/lesser.html for details.
 // Initialization
-require_once( '../../kernel/includes/setup_inc.php' );
+require_once '../../kernel/includes/setup_inc.php';
 
 // PERMISSIONS: NEEDS admin
 $gBitSystem->verifyPermission( 'p_users_admin' );
 
-$successMsg = NULL;
-$errorMsg = NULL;
+$successMsg = null;
+$errorMsg = null;
 
 if( count( $_GET ) > 2 || count( $_POST ) > 2 ) {
 	$gBitUser->verifyTicket();
 }
 
 if( !empty( $_REQUEST['role_id'] ) ) {
-	$permListHash = array(
-		'sort_mode' => !empty( $_REQUEST['sort_mode'] ) ? $_REQUEST['sort_mode'] : NULL,
-		'package' => !empty( $_REQUEST['package'] ) ? $_REQUEST['package'] : NULL,
-	);
+	$permListHash = [
+		'sort_mode' => !empty( $_REQUEST['sort_mode'] ) ? $_REQUEST['sort_mode'] : null,
+		'package'   => !empty( $_REQUEST['package'] ) ? $_REQUEST['package'] : null,
+	];
 	$allPerms = $gBitUser->getRolePermissions( $permListHash );
 }
 
 if( !empty( $_REQUEST["cancel"] ) ) {
-	bit_redirect( USERS_PKG_URL.'admin/edit_role.php' );
+	KernelTools::bit_redirect( USERS_PKG_URL.'admin/edit_role.php' );
 } elseif( isset( $_REQUEST["batch_assign"] ) ) {
 	$roleInfo = $gBitUser->getRoleInfo( $_REQUEST['batch_assign'] );
 	if( isset( $_REQUEST["confirm"] ) ) {
 		$gBitUser->batchAssignUsersToRole( $_REQUEST['batch_assign'] );
 	} else {
-		$gBitSystem->setBrowserTitle( tra( 'Confirm Batch Role Assignment' ) );
+		$gBitSystem->setBrowserTitle( KernelTools::tra( 'Confirm Batch Role Assignment' ) );
 		$formHash['batch_assign'] = $_REQUEST["batch_assign"];
 		$msgHash = array(
-			'label' => tra( 'Batch Assign Users to Role' ),
+			'label' => KernelTools::tra( 'Batch Assign Users to Role' ),
 			'confirm_item' => $roleInfo['role_name'],
-			'warning' => tra( 'This will assign every user on the site to the role' ).' <strong>'.$roleInfo['role_name'].'</strong>',
+			'warning' => KernelTools::tra( 'This will assign every user on the site to the role' ).' <strong>'.$roleInfo['role_name'].'</strong>',
 		);
 		$gBitSystem->confirmDialog( $formHash,$msgHash );
 	}
 } elseif( isset($_REQUEST["members"] ) ) {
 	$roleInfo = $gBitUser->getRoleInfo( $_REQUEST["members"] );
-	$gBitSmarty->assignByRef( 'roleInfo', $roleInfo );
+	$gBitSmarty->assign( 'roleInfo', $roleInfo );
 	$roleMembers = $gBitUser->getRoleUsers( $_REQUEST["members"] );
-	$gBitSmarty->assignByRef( 'roleMembers', $roleMembers );
+	$gBitSmarty->assign( 'roleMembers', $roleMembers );
 	$mid = "bitpackage:users/role_list_members.tpl";
-	$gBitSystem->setBrowserTitle( tra( 'Role Members' ).': '.$roleInfo['role_name'] );
+	$gBitSystem->setBrowserTitle( KernelTools::tra( 'Role Members' ).': '.$roleInfo['role_name'] );
 } elseif( isset($_REQUEST["save"] ) ) {
 	if( empty($_REQUEST["name"] ) ) {
 		$_REQUEST["name"] = $_REQUEST["olrole"];
@@ -63,7 +65,7 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 		$gBitSystem->storeConfig( 'default_home_role', $_REQUEST['role_id'], USERS_PKG_NAME );
 	} elseif( $_REQUEST['role_id'] == $gBitSystem->getConfig( 'default_home_role' ) ) {
 		// the default home role was unchecked.
-		$gBitSystem->storeConfig( 'default_home_role', NULL, USERS_PKG_NAME );
+		$gBitSystem->storeConfig( 'default_home_role', null, USERS_PKG_NAME );
 	}
 
 //	$mid = 'bitpackage:users/admin_troles_list.tpl';
@@ -87,16 +89,16 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 		if( isset( $_REQUEST["confirm"] ) ) {
 			$gBitUser->verifyTicket();
 			if( $_REQUEST['role_id'] == $gBitSystem->getConfig( 'default_home_role' ) ) {
-				$gBitSystem->storeConfig( 'default_home_role', NULL, USERS_PKG_NAME );
+				$gBitSystem->storeConfig( 'default_home_role', null, USERS_PKG_NAME );
 			}
 			$gBitUser->expungeRole( $_REQUEST['role_id'] );
 			$successMsg = "The role ".$roleInfo['role_name']." was deleted.";
 			unset( $_REQUEST['role_id'] );
 		} else {
-			$gBitSystem->setBrowserTitle( tra('Delete role') );
+			$gBitSystem->setBrowserTitle( KernelTools::tra('Delete role') );
 			$msgHash = array(
-				'confirm_item' => tra( 'Are you sure you want to remove the role?' ),
-				'warning' => tra( 'This will permentally delete the role' )." <strong>$roleInfo[role_name]</strong>",
+				'confirm_item' => KernelTools::tra( 'Are you sure you want to remove the role?' ),
+				'warning' => KernelTools::tra( 'This will permentally delete the role' )." <strong>$roleInfo[role_name]</strong>",
 			);
 			$gBitSystem->confirmDialog( $formHash,$msgHash );
 		}
@@ -105,7 +107,7 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 		$successMsg = 'The permission '.$_REQUEST['permission'].' was removed successflly. <a href="'.USERS_PKG_URL.'admin/edit_role.php?action=assign&amp;perm='.$_REQUEST['permission'].'&amp;role_id='.$_REQUEST['role_id'].'&amp;pacakge='.$_REQUEST['package'].'">Undo last action.</a>';
 	} elseif( $_REQUEST["action"] == 'create' ) {
 		$mid = 'bitpackage:users/admin_role_edit.tpl';
-		$gBitSystem->setBrowserTitle( tra( 'Create New Role' ) );
+		$gBitSystem->setBrowserTitle( KernelTools::tra( 'Create New Role' ) );
 	} elseif ($_REQUEST["action"] == 'assign') {
 		$gBitUser->assignPermissionToRole($_REQUEST["perm"], $_REQUEST['role_id']);
 	}
@@ -113,7 +115,7 @@ if( !empty( $_REQUEST["cancel"] ) ) {
 
 if( !empty( $_REQUEST['role_id'] ) || (!empty( $_REQUEST["action"] ) && $_REQUEST["action"] == 'create' ) ) {
 	$permPackages = $gBitUser->getPermissionPackages();
-	$gBitSmarty->assignByRef( 'permPackages', $permPackages );
+	$gBitSmarty->assign( 'permPackages', $permPackages );
 
 	// get role list separately from the $users stuff to avoid splitting of data due to pagination
 	$listHash = array( 'sort_mode' => 'role_name_asc' );
@@ -127,7 +129,7 @@ if( !empty( $_REQUEST['role_id'] ) || (!empty( $_REQUEST["action"] ) && $_REQUES
 	$gBitSmarty->assign( 'contentList', $cList );
 	$gBitSmarty->assign( 'contentSelect', $contentSelect );
 */
-	$contentTypes = array( '' => tra( 'All Content' ) );
+	$contentTypes = array( '' => KernelTools::tra( 'All Content' ) );
 	foreach( $gLibertySystem->mContentTypes as $cType ) {
 		$contentTypes[$cType['content_type_guid']] = $gLibertySystem->getContentTypeName( $cType['content_type_guid'] );
 	}
@@ -138,20 +140,20 @@ if( !empty( $_REQUEST['role_id'] ) || (!empty( $_REQUEST["action"] ) && $_REQUES
 }
 $gBitSmarty->assign('roleList', $gBitUser->getAllRoles( $listHash ));
 
-$inc = array();
+$inc = [];
 if( empty( $mid ) ) {
 	if( !empty( $_REQUEST['role_id'] ) ) {
 		$roleInfo = $gBitUser->getRoleInfo( $_REQUEST['role_id'] );
 
 		$defaultRoleId = $gBitSystem->getConfig( 'default_home_role' );
-		$gBitSmarty->assignByRef( 'defaultRoleId', $defaultRoleId );
-		$gBitSmarty->assignByRef( 'roleInfo', $roleInfo );
-		$gBitSmarty->assignByRef( 'allPerms', $allPerms );
+		$gBitSmarty->assign( 'defaultRoleId', $defaultRoleId );
+		$gBitSmarty->assign( 'roleInfo', $roleInfo );
+		$gBitSmarty->assign( 'allPerms', $allPerms );
 
-		$gBitSystem->setBrowserTitle( tra( 'Admininster Role' ).': '.$roleInfo['role_name'] );
+		$gBitSystem->setBrowserTitle( KernelTools::tra( 'Admininster Role' ).': '.$roleInfo['role_name'] );
 		$mid = 'bitpackage:users/admin_role_edit.tpl';
 	} else {
-		$gBitSystem->setBrowserTitle( tra( 'Admin List Roles' ) );
+		$gBitSystem->setBrowserTitle( KernelTools::tra( 'Admin List Roles' ) );
 		$_REQUEST['role_id'] = 0;
 		$mid = 'bitpackage:users/admin_roles_list.tpl';
 	}
@@ -161,5 +163,4 @@ $gBitSmarty->assign('successMsg',$successMsg);
 $gBitSmarty->assign('errorMsg',$errorMsg);
 
 // Display the template for role administration
-$gBitSystem->display( $mid , NULL, array( 'display_mode' => 'edit' ));
-?>
+$gBitSystem->display( $mid , null, [ 'display_mode' => 'edit' ]);
diff --git a/admin/index.php b/admin/index.php
index db87354..b9f16a0 100644..100755
--- a/admin/index.php
+++ b/admin/index.php
@@ -4,15 +4,20 @@
 // All Rights Reserved. See below for details and a complete list of authors.
 // Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See http://www.gnu.org/copyleft/lesser.html for details.
 // Initialization
-require_once( '../../kernel/includes/setup_inc.php' );
+namespace Bitweaver\Users;
+use Bitweaver\BitBase;
+use Bitweaver\KernelTools;
+
+require_once '../../kernel/includes/setup_inc.php';
 
 $gBitSystem->verifyPermission( 'p_users_admin' );
 
-$feedback = array();
+$feedback = [];
 
 if( isset($_REQUEST["newuser"] ) ) {
 	$userRecord = $_REQUEST;
-	$newUser = new BitPermUser();
+	$newUser =  defined( 'ROLE_MODEL' ) ? new RolePermUser() : new BitPermUser();
+
 	if( $newUser->importUser( $userRecord ) ) {
 		$gBitSmarty->assign( 'addSuccess', "User Added Successfully" );
 		if( empty( $_REQUEST['admin_noemail_user'] ) ) {
@@ -26,11 +31,11 @@ if( isset($_REQUEST["newuser"] ) ) {
 			$newUser->storeActionLog( $logHash );
 		}
 	} else {
-		$gBitSmarty->assignByRef( 'newUser', $_REQUEST );
+		$gBitSmarty->assign( 'newUser', $_REQUEST );
 		$gBitSmarty->assign( 'errors', $newUser->mErrors );
 	}
 } elseif( isset( $_REQUEST["assume_user"]) && $gBitUser->hasPermission( 'p_users_admin' ) ) {
-	$assume_user = (is_numeric( $_REQUEST["assume_user"] )) ? array( 'user_id' => $_REQUEST["assume_user"] ) : array('login' => $_REQUEST["assume_user"]) ;
+	$assume_user = (is_numeric( $_REQUEST["assume_user"] )) ? [ 'user_id' => $_REQUEST["assume_user"] ] : [ 'login' => $_REQUEST["assume_user"] ];
 	$userInfo = $gBitUser->getUserInfo( $assume_user );
 	if( isset( $_REQUEST["confirm"] ) ) {
 		$gBitUser->verifyTicket();
@@ -39,16 +44,16 @@ if( isset($_REQUEST["newuser"] ) ) {
 			die;
 		}elseif( !empty( $gBitUser->mErrors ) ){
 			if ( !isset( $feedback['error'] ) ){
-				$feedback['error'] = array();
+				$feedback['error'] = [];
 			}
 			$feedback['error'] = array_merge( $feedback['error'], $gBitUser->mErrors ); 
 		}
 	} else {
 		$gBitSystem->setBrowserTitle( 'Assume User Identity' );
 		$formHash['assume_user'] = $_REQUEST['assume_user'];
-		$msgHash = array(
-			'confirm_item' => tra( 'This will log you in as the user' )." <strong>$userInfo[real_name] ($userInfo[login])</strong>",
-		);
+		$msgHash = [
+			'confirm_item' => KernelTools::tra( 'This will log you in as the user' ) . " <strong>$userInfo[real_name] ($userInfo[login])</strong>",
+		];
 		$gBitSystem->confirmDialog( $formHash,$msgHash );
 	}
 } elseif( !empty( $_REQUEST['find'] ) ) {
@@ -62,13 +67,13 @@ if( isset( $_REQUEST["action"] ) ) {
 		if( $formHash['action'] == 'export' ) {
 			$file = tempnam( sys_get_temp_dir(), 'users' );
 			$fp = fopen($file, 'w');
-			$printHeader = TRUE;
+			$printHeader = true;
 			foreach( $_REQUEST['batch_user_ids'] as $uid ) {
 				$listUser = BitUser::getUserObject( $uid );
 				$hash = $listUser->exportHash();
 				if( $printHeader ) {
 					fputcsv( $fp, array_keys( $hash ) );
-					$printHeader = FALSE;
+					$printHeader = false;
 				}
 				fputcsv( $fp, $hash );
 			}
@@ -84,39 +89,37 @@ if( isset( $_REQUEST["action"] ) ) {
 			$delUsers = $errDelUsers = "";
 			foreach( $_REQUEST['batch_user_ids'] as $uid ) {
 				$expungeUser = BitUser::getUserObject( $uid );
-				$userInfo = $gBitUser->getUserInfo( array( 'user_id' => $uid ) );
+				$userInfo = $gBitUser->getUserInfo( [ 'user_id' => $uid ] );
 				if( $expungeUser->load() && $expungeUser->expunge( BitBase::getParameter( $_REQUEST, 'delete_user_content' ) ) ) {
 					$delUsers .= "<li>{$userInfo['real_name']} ({$userInfo['login']})</li>";
 				} else {
-					$errDelUsers .= "<li>User $uid could not be deleted:".var_export( $expungeUser->mErrors, TRUE )."</li>";
+					$errDelUsers .= "<li>User $uid could not be deleted:".var_export( $expungeUser->mErrors, true )."</li>";
 				}
 			}
 
 			if( !empty( $delUsers ) ) {
-				$feedback['success'][] = tra( 'Users deleted' ).": <ul>$delUsers</ul>";
+				$feedback['success'][] = KernelTools::tra( 'Users deleted' ).": <ul>$delUsers</ul>";
 			} 
 			if( !empty( $errDelUsers ) ) {
-				$feedback['error'][] = tra( 'Users not deleted' ).": <ul>$errDelUsers</ul>";
+				$feedback['error'][] = KernelTools::tra( 'Users not deleted' ).": <ul>$errDelUsers</ul>";
 			}
 		} else {
 			foreach( $_REQUEST['batch_user_ids'] as $uid ) {
-				if( $userInfo = $gBitUser->getUserInfo( array( 'user_id' => $uid ) ) ) {
-					$formHash['input'][] = '<input type="hidden" name="batch_user_ids[]" value="'.$uid.'"/>'."{$userInfo['real_name']} ({$userInfo['login']})<br/>&lt;{$userInfo['email']}&gt;";
-				} else {
-					$formHash['input'][] = '<span class="error"/>'.$uid.' '.tra('not found').'</span>';
-				}
+				$formHash['input'][] = ( $userInfo = $gBitUser->getUserInfo( [ 'user_id' => $uid ] ) ) 
+					? '<input type="hidden" name="batch_user_ids[]" value="' . $uid . '"/>' . "{$userInfo['real_name']} ({$userInfo['login']})<br/>&lt;{$userInfo['email']}&gt;" 
+					: '<span class="error"/>' . $uid . ' ' . KernelTools::tra( 'not found' ) . '</span>';
 			}
-			$formHash['input'][] = "<input type='checkbox' name='delete_user_content' value='all' checked='checked'/> ".tra( 'Delete all content created by this user' );
+			$formHash['input'][] = "<input type='checkbox' name='delete_user_content' value='all' checked='checked'/> ".KernelTools::tra( 'Delete all content created by this user' );
 			$gBitSystem->setBrowserTitle( 'Delete users' );
-			$msgHash = array(
-				'confirm_item' => tra( 'Are you sure you want to remove these users?' ),
-				'warning' => tra( 'This will permentally delete these users' ),
-			);
+			$msgHash = [
+				'confirm_item' => KernelTools::tra( 'Are you sure you want to remove these users?' ),
+				'warning'      => KernelTools::tra( 'This will permentally delete these users' ),
+			];
 			$gBitSystem->confirmDialog( $formHash, $msgHash );
 		}
 	} elseif( $_REQUEST["action"] == 'delete' ||  $_REQUEST["action"] == 'ban' ||  $_REQUEST["action"] == 'unban'  ) {
 		$formHash['user_id'] = $_REQUEST['user_id'];
-		$userInfo = $gBitUser->getUserInfo( array( 'user_id' => $_REQUEST["user_id"] ) );
+		$userInfo = $gBitUser->getUserInfo( [ 'user_id' => $_REQUEST["user_id"] ] );
 		if( !empty( $userInfo['user_id'] ) ) {
 				$userClass = $gBitSystem->getConfig( 'user_class', 'BitPermUser' );
 				$reqUser = new $userClass( $_REQUEST["user_id"] );
@@ -125,62 +128,62 @@ if( isset( $_REQUEST["action"] ) ) {
 				switch(  $_REQUEST["action"] ){
 					case 'delete':
 						$reqUser->StartTrans();
-						if( $reqUser->load(TRUE) && $reqUser->expunge( !empty( $_REQUEST['delete_user_content'] ) ? $_REQUEST['delete_user_content'] : NULL ) ) {
-							$feedback['success'][] = tra( 'User deleted' )." <strong>{$userInfo['real_name']} ({$userInfo['login']}) &lt;{$userInfo['email']}&gt;</strong>";
+						if( $reqUser->load(true) && $reqUser->expunge( !empty( $_REQUEST['delete_user_content'] ) ? $_REQUEST['delete_user_content'] : null ) ) {
+							$feedback['success'][] = KernelTools::tra( 'User deleted' )." <strong>{$userInfo['real_name']} ({$userInfo['login']}) &lt;{$userInfo['email']}&gt;</strong>";
 						}
 						$reqUser->CompleteTrans();
 						break;
 					case 'ban':
 						if( $reqUser->load() && $reqUser->ban() ) {
-							$feedback['success'][] = tra( 'User banned' )." <strong>{$userInfo['real_name']} ({$userInfo['login']})</strong>";
+							$feedback['success'][] = KernelTools::tra( 'User banned' )." <strong>{$userInfo['real_name']} ({$userInfo['login']})</strong>";
 						}
 						break;
 					case 'unban':
 						if( $reqUser->load() && $reqUser->unban() ) {
-							$feedback['success'][] = tra( 'User restored' )." <strong>{$userInfo['real_name']} ({$userInfo['login']})</strong>";
+							$feedback['success'][] = KernelTools::tra( 'User restored' )." <strong>{$userInfo['real_name']} ({$userInfo['login']})</strong>";
 						}
 						break;
 				}
 			} else {
 				switch( $_REQUEST["action"] ){
 					case 'delete':
-						$gBitSystem->setBrowserTitle( tra( 'Delete user' ).' '.$reqUser->getDisplayName() );
+						$gBitSystem->setBrowserTitle( KernelTools::tra( 'Delete user' ).' '.$reqUser->getDisplayName() );
 			$reqUser->invokeServices( 'users_expunge_check_function' );
 			if( !empty( $reqUser->mErrors['expunge_check'] ) ) {
 				$feedback['error'] = $reqUser->mErrors;
 			} else {
-						$formHash['input'][] = "<div class='checkbox'><label><input type='checkbox' name='delete_user_content' value='all' checked='checked'/>".tra( 'Delete all content created by this user' ).'</label></div>';
+						$formHash['input'][] = "<div class='checkbox'><label><input type='checkbox' name='delete_user_content' value='all' checked='checked'/>".KernelTools::tra( 'Delete all content created by this user' ).'</label></div>';
 						foreach( $gLibertySystem->mContentTypes as $contentTypeGuid => $contentTypeHash ) {
-//							$formHash['input'][] = "<input type='checkbox' name='delete_user_content' checked='checked' value='$contentTypeGuid'/>Delete All User's $gLibertySystem->getContentTypeName($contentTypeHash['content_type_guid'],TRUE)";
+//							$formHash['input'][] = "<input type='checkbox' name='delete_user_content' checked='checked' value='$contentTypeGuid'/>Delete All User's $gLibertySystem->getContentTypeName($contentTypeHash['content_type_guid'],true)";
 						}
 
-						$msgHash = array(
-							'confirm_item' => tra( 'Are you sure you want to remove the user?' ),
-							'warning' => tra( 'This will permentally delete the user' )." <strong>$userInfo[real_name] ($userInfo[login]) &lt;$userInfo[email]&gt;</strong>",
-						);
+						$msgHash = [
+								'confirm_item' => KernelTools::tra( 'Are you sure you want to remove the user?' ),
+								'warning'      => KernelTools::tra( 'This will permentally delete the user' ) . " <strong>$userInfo[real_name] ($userInfo[login]) &lt;$userInfo[email]&gt;</strong>",
+							];
 						$gBitSystem->confirmDialog( $formHash,$msgHash );
 			}
 						break;
 					case 'ban':
-						$gBitSystem->setBrowserTitle( tra( 'Disable User' ) );
-						$msgHash = array(
-							'confirm_item' => tra( 'Are you sure you want to disable this user account?' ),
-							'warning' => tra( 'This will suspend access for user' )." <strong>$userInfo[real_name] ($userInfo[login])</strong>",
-						);
+						$gBitSystem->setBrowserTitle( KernelTools::tra( 'Disable User' ) );
+						$msgHash = [
+							'confirm_item' => KernelTools::tra( 'Are you sure you want to disable this user account?' ),
+							'warning'      => KernelTools::tra( 'This will suspend access for user' ) . " <strong>$userInfo[real_name] ($userInfo[login])</strong>",
+						];
 						$gBitSystem->confirmDialog( $formHash,$msgHash );
 						break;
 					case 'unban':
-						$gBitSystem->setBrowserTitle( tra( 'Re-enable user' ) );
-						$msgHash = array(
-							'confirm_item' => tra( 'Are you sure you want to re-enable this user?' ),
-							'warning' => tra( 'This will restore access for user' )." <strong>$userInfo[real_name] ($userInfo[login])</strong>",
-						);
+						$gBitSystem->setBrowserTitle( KernelTools::tra( 'Re-enable user' ) );
+						$msgHash = [
+							'confirm_item' => KernelTools::tra( 'Are you sure you want to re-enable this user?' ),
+							'warning'      => KernelTools::tra( 'This will restore access for user' ) . " <strong>$userInfo[real_name] ($userInfo[login])</strong>",
+						];
 						$gBitSystem->confirmDialog( $formHash,$msgHash );
 						break;
 				}
 			}
 		} else {
-			$feedback['error'][] = tra( 'User not found' );
+			$feedback['error'][] = KernelTools::tra( 'User not found' );
 		}
 	}
 	if ($_REQUEST["action"] == 'removerole') {
@@ -191,34 +194,47 @@ if( isset( $_REQUEST["action"] ) ) {
 	}
 }
 
-// get default group and pass it to tpl
-foreach( $gBitUser->getDefaultGroup() as $defaultGroupId => $defaultGroupName ) {
-	$gBitSmarty->assign('defaultGroupId', $defaultGroupId );
-	$gBitSmarty->assign('defaultGroupName', $defaultGroupName );
+if ( defined( 'ROLE_MODEL' ) ) {
+	// get default role and pass it to tpl
+	foreach( $gBitUser->getDefaultRole() as $defaultRoleId => $defaultRoleName ) {
+		$gBitSmarty->assign('defaultRoleId', $defaultRoleId );
+		$gBitSmarty->assign('defaultRoleName', $defaultRoleName );
+	}
+} else {
+	// get default group and pass it to tpl
+	foreach( $gBitUser->getDefaultGroup() as $defaultGroupId => $defaultGroupName ) {
+		$gBitSmarty->assign('defaultGroupId', $defaultGroupId );
+		$gBitSmarty->assign('defaultGroupName', $defaultGroupName );
+	}
 }
 
 // override default max_records
 $listHash = $_REQUEST;
 $listHash['max_records'] = !empty( $_REQUEST['max_records'] ) ? $_REQUEST['max_records'] : $gBitSystem->getConfig('max_records');
 $users = $gBitUser->getList( $listHash );
-$gBitSmarty->assignByRef('users', $users );
-$gBitSmarty->assignByRef('usercount', $listHash["cant"]);
-if (isset($listHash["numrows"])) {
-	$listHash['listInfo']["numrows"] = $listHash["numrows"];
-} else {
-	$listHash['listInfo']["numrows"] = 10;
-}
+$gBitSmarty->assign('users', $users );
+$gBitSmarty->assign('usercount', $listHash["cant"]);
+$listHash['listInfo']["numrows"] = $listHash["numrows"] ?? 10;
 $listHash['listInfo']["URL"] = USERS_PKG_URL."admin/index.php";
-$gBitSmarty->assignByRef('listInfo', $listHash['listInfo']);
+$gBitSmarty->assign('listInfo', $listHash['listInfo']);
 
-// invoke edit service for the add user feature
-$userObj = new BitPermUser();
-$userObj->invokeServices( 'content_edit_function' );	// Get groups (list of groups)
-$grouplist = $gBitUser->getGroups('', '', 'group_name_asc');
-$gBitSmarty->assign( 'grouplist', $grouplist );
+if ( defined( 'ROLE_MODEL' ) ) {
+	// invoke edit service for the add user feature
+	$userObj = new RolePermUser();
+	$userObj->invokeServices( 'content_edit_function' );
+	// Get roles (list of roles)
+	$rolelist = $gBitUser->getRoles(0, false);
+	$gBitSmarty->assign( 'rolelist', $rolelist );
+} else {
+	// invoke edit service for the add user feature
+	$userObj = new BitPermUser();
+	$userObj->invokeServices( 'content_edit_function' );	// Get groups (list of groups)
+	$grouplist = $gBitUser->getGroups('', '', 'group_name_asc');
+	$gBitSmarty->assign( 'grouplist', $grouplist );
+}
 $gBitSmarty->assign( 'feedback', $feedback );
 
 $gBitSmarty->assign( (!empty( $_REQUEST['tab'] ) ? $_REQUEST['tab'] : 'userlist').'TabSelect', 'tdefault' );
 
 // Display the template
-$gBitSystem->display( 'bitpackage:users/admin_list_users.tpl', (!empty( $title ) ? $title : 'Edit Users' ) , array( 'display_mode' => 'admin' ));
+$gBitSystem->display( 'bitpackage:users/admin_list_users.tpl', !empty( $title ) ? $title : 'Edit Users' , [ 'display_mode' => 'admin' ]);
diff --git a/admin/permissions.php b/admin/permissions.php
index 39d8854..909a3b3 100644..100755
--- a/admin/permissions.php
+++ b/admin/permissions.php
@@ -2,11 +2,11 @@
 require_once( '../../kernel/includes/setup_inc.php' );
 $gBitSystem->verifyPermission( 'p_admin' );
 
-$feedback = array();
+$feedback = [];
 
 // get a list of all groups and their permissions
 $listHash = array(
-	'only_root_groups' => TRUE,
+	'only_root_groups' => true,
 	'sort_mode' => !empty( $_REQUEST['sort_mode'] ) ? $_REQUEST['sort_mode'] : 'group_name_asc'
 );
 $allGroups = $gBitUser->getAllGroups( $listHash );
diff --git a/admin/role_permissions.php b/admin/role_permissions.php
index d68ece0..c50dd8b 100644..100755
--- a/admin/role_permissions.php
+++ b/admin/role_permissions.php
@@ -1,14 +1,16 @@
 <?php
-require_once( '../../kernel/includes/setup_inc.php' );
+use Bitweaver\KernelTools;
+use Bitweaver\Liberty\LibertyContent;
+require_once '../../kernel/includes/setup_inc.php';
 $gBitSystem->verifyPermission( 'p_admin' );
 
-$feedback = array();
+$feedback = [];
 
 // get a list of all roles and their permissions
-$listHash = array(
-	'only_root_roles' => TRUE,
-	'sort_mode' => !empty( $_REQUEST['sort_mode'] ) ? $_REQUEST['sort_mode'] : 'role_name_asc'
-);
+$listHash = [
+	'only_root_roles' => true,
+	'sort_mode'       => !empty( $_REQUEST['sort_mode'] ) ? $_REQUEST['sort_mode'] : 'role_name_asc'
+];
 $allRoles = $gBitUser->getAllRoles( $listHash );
 $allPerms = $gBitUser->getRolePermissions( $_REQUEST );
 
@@ -25,14 +27,14 @@ if( !empty( $_REQUEST['save'] )) {
 		}
 	}
 
-	$feedback['success'] = tra( "The permissions were successfully added to the requested roles." );
+	$feedback['success'] = KernelTools::tra( "The permissions were successfully added to the requested roles." );
 	// we need to update the roles list
 	$allRoles = $gBitUser->getAllRoles( $listHash );
 }
 
 // Check to see if we have unassigned permissions
 if(( $unassignedPerms = $gBitUser->getUnassignedPerms() )) {
-	$feedback['warning'] = tra( 'You have some permissions that are not assigned to any role. You need to assign these to at least one role each.' );
+	$feedback['warning'] = KernelTools::tra( 'You have some permissions that are not assigned to any role. You need to assign these to at least one role each.' );
 	$gBitSmarty->assign( 'unassignedPerms', $unassignedPerms );
 }
 
@@ -40,7 +42,7 @@ $gBitSmarty->assign( 'allPerms', $allPerms );
 $gBitSmarty->assign( 'allRoles', $allRoles );
 $gBitSmarty->assign( 'permPackages', $gBitUser->getPermissionPackages() );
 $gBitSmarty->assign( 'feedback', $feedback );
+$gBitSmarty->assign( 'bitTk', $gBitUser->mTicket );
 $gBitSmarty->assign( 'contentWithPermissions', LibertyContent::getContentWithPermissionsList() );
 
-$gBitSystem->display( 'bitpackage:users/admin_role_permissions.tpl', tra( 'Permission Maintenance' ), array( 'display_mode' => 'admin' ));
-?>
+$gBitSystem->display( 'bitpackage:users/admin_role_permissions.tpl', KernelTools::tra( 'Permission Maintenance' ), [ 'display_mode' => 'admin' ]);
diff --git a/admin/upgrade_inc.php b/admin/upgrade_inc.php
index 1749904..089f23b 100644..100755
--- a/admin/upgrade_inc.php
+++ b/admin/upgrade_inc.php
@@ -325,15 +325,15 @@ array( 'PHP' => '
 // STEP 4
 array( 'DATADICT' => array(
 array( 'CREATEINDEX' => array(
-		'tiki_sema_user_idx' => array( 'tiki_semaphores', '`user_id`', array() ),
-		'tiki_user_prefs_idx' => array( 'tiki_user_preferences', '`user_id`', array() ),
+		'tiki_sema_user_idx' => array( 'tiki_semaphores', '`user_id`', [] ),
+		'tiki_user_prefs_idx' => array( 'tiki_user_preferences', '`user_id`', [] ),
 		'tiki_user_prefs_un_idx' => array( 'tiki_user_preferences', '`user_id`,`pref_name`', array( 'UNIQUE' ) ),
-		'users_groups_map_user_idx' => array( 'users_groups_map', '`user_id`', array() ),
-		'users_groups_map_group_idx' => array( 'users_groups_map', '`group_id`', array() ),
+		'users_groups_map_user_idx' => array( 'users_groups_map', '`user_id`', [] ),
+		'users_groups_map_group_idx' => array( 'users_groups_map', '`group_id`', [] ),
 		'users_groups_map_ug_idx' => array( 'users_groups_map', '`user_id`,`group_id`', array( 'UNIQUE' ) ),
-		'users_groupperms_group_idx' => array( 'users_grouppermissions', '`group_id`', array() ),
+		'users_groupperms_group_idx' => array( 'users_grouppermissions', '`group_id`', [] ),
 		'users_groupperms_group_idx' => array( 'users_grouppermissions', '`group_id`,`perm_name`', array( 'UNIQUE' ) ),
-		'users_groups_inc_group_idx' => array( 'users_groups_inclusion', '`group_id`', array() ),
+		'users_groups_inc_group_idx' => array( 'users_groups_inclusion', '`group_id`', [] ),
 		'users_groups_inc_gi_idx' => array( 'users_groups_inclusion', '`group_id`,`include_group_id`', array( 'UNIQUE' ) ),
 		'users_groups_gi_idx'  => array( 'users_groups', '`group_id`', array('UNIQUE') ),
 	)),
diff --git a/admin/upgrades/2.1.0.php b/admin/upgrades/2.1.0.php
deleted file mode 100644
index 34ce4ec..0000000
--- a/admin/upgrades/2.1.0.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-/**
- * @version $Header$
- */
-global $gBitInstaller;
-
-$infoHash = array(
-	'package'      => USERS_PKG_NAME,
-	'version'      => str_replace( '.php', '', basename( __FILE__ )),
-	'description'  => "Remove the unused <em>users_semaphores</em> table from your database. If you need a semaphores feature, there is a <a class='external' href='http://www.bitweaver.org/wiki/SemaphorePackage'>SemaphorePackage</a> now.",
-	'post_upgrade' => NULL,
-);
-$gBitInstaller->registerPackageUpgrade( $infoHash, array(
-
-array( 'DATADICT' => array(
-	array( 'DROPTABLE' => array(
-		'users_semaphores',
-	)),
-)),
-
-));
-?>
diff --git a/admin/upgrades/2.1.1.php b/admin/upgrades/2.1.1.php
deleted file mode 100644
index 32c5883..0000000
--- a/admin/upgrades/2.1.1.php
+++ /dev/null
@@ -1,26 +0,0 @@
-<?php
-/**
- * @version $Header$
- */
-global $gBitInstaller;
-
-$infoHash = array(
-	'package'      => USERS_PKG_NAME,
-	'version'      => str_replace( '.php', '', basename( __FILE__ )),
-	'description'  => "Minor fix to ip columns to support IPv6",
-	'post_upgrade' => NULL,
-);
-
-// Increase the size of the IP column to cope with IPv6
-$gBitInstaller->registerPackageUpgrade( $infoHash, array(
-
-array( 'QUERY' =>
-	array(
-		'PGSQL' => array( "ALTER TABLE `".BIT_DB_PREFIX."users_cnxn` ALTER `ip` TYPE VARCHAR(39)" ,),
-		'OCI'   => array( "ALTER TABLE `".BIT_DB_PREFIX."users_cnxn` MODIFY (`ip` TYPE VARCHAR2(39))" ,),
-		'MYSQL' => array( "ALTER TABLE `".BIT_DB_PREFIX."users_cnxn` MODIFY `ip` VARCHAR(39)" ,),
-	),
-),
-
-));
-?>
diff --git a/admin/upgrades/2.1.2.php b/admin/upgrades/2.1.2.php
deleted file mode 100644
index 38ba3cb..0000000
--- a/admin/upgrades/2.1.2.php
+++ /dev/null
@@ -1,24 +0,0 @@
-<?php
-/**
- * @version $Header$
- */
-global $gBitInstaller;
-
-$infoHash = array(
-	'package'      => USERS_PKG_NAME,
-	'version'      => str_replace( '.php', '', basename( __FILE__ )),
-	'description'  => "Clean expiring password values since feature was previously non-functional.",
-	'post_upgrade' => NULL,
-);
-
-$gBitInstaller->registerPackageUpgrade( $infoHash, array(
-
-array( 'PHP' => '
-	// make sure plugins are up to date.
-	global $gBitDb;
-	$gBitDb->query( "UPDATE `".BIT_DB_PREFIX."users_users` SET `pass_due`=NULL" );
-'
-)
-
-));
-?>
diff --git a/admin/upgrades/5.0.0.php b/admin/upgrades/5.0.0.php
new file mode 100755
index 0000000..bf7e79e
--- /dev/null
+++ b/admin/upgrades/5.0.0.php
@@ -0,0 +1,12 @@
+<?php
+/**
+ * @version $Header$
+ */
+global $gBitInstaller;
+
+$infoHash = [
+	'package'     => USERS_PKG_NAME,
+	'version'     => str_replace( '.php', '', basename( __FILE__ ) ),
+	'description' => "Set core package version number.",
+];
+$gBitInstaller->registerPackageUpgrade( $infoHash );
diff --git a/admin/upgrades/roles_upgrade.sql b/admin/upgrades/roles_upgrade.sql
new file mode 100755
index 0000000..d53d397
--- /dev/null
+++ b/admin/upgrades/roles_upgrade.sql
@@ -0,0 +1,139 @@
+CREATE GENERATOR USERS_ROLES_ID_SEQ;
+SET GENERATOR USERS_ROLES_ID_SEQ TO 3;
+DROP GENERATOR USERS_GROUPS_ID_SEQ;
+
+CREATE TABLE LIBERTY_CONTENT_ROLE_MAP
+(
+  CONTENT_ID Integer NOT NULL,
+  ROLE_ID Integer NOT NULL,
+  PRIMARY KEY (CONTENT_ID,ROLE_ID)
+);
+
+COMMIT;
+
+INSERT INTO LIBERTY_CONTENT_ROLE_MAP ( CONTENT_ID, ROLE_ID )
+SELECT lg.CONTENT_ID, lg.GROUP_ID AS ROLE_ID FROM LIBERTY_CONTENT_GROUP_MAP lg;
+
+DROP TABLE LIBERTY_CONTENT_GROUP_MAP;
+
+ALTER TABLE LIBERTY_CONTENT_PERMISSIONS DROP CONSTRAINT LIBERTY_CONTENT_PERM_GROUP_REF;
+ALTER TABLE LIBERTY_CONTENT_PERMISSIONS DROP CONSTRAINT INTEG_83;
+ALTER TABLE LIBERTY_CONTENT_PERMISSIONS ALTER GROUP_ID TO ROLE_ID;
+ALTER TABLE LIBERTY_CONTENT_PERMISSIONS
+ADD CONSTRAINT PK_LIBERTY_CONTENT_PERMISSIONS
+PRIMARY KEY (ROLE_ID, PERM_NAME, CONTENT_ID);
+
+ALTER TABLE THEMES_LAYOUTS ALTER GROUPS TO ROLES;
+
+CREATE TABLE USERS_ROLES
+(
+  ROLE_ID Integer NOT NULL,
+  USER_ID Integer NOT NULL,
+  ROLE_NAME Varchar(30),
+  IS_DEFAULT Varchar(1),
+  ROLE_DESC Varchar(255),
+  ROLE_HOME Varchar(255),
+  IS_PUBLIC Varchar(1),
+  AFTER_REGISTRATION_PAGE Varchar(255),
+  PRIMARY KEY (ROLE_ID)
+);
+
+CREATE TABLE USERS_ROLES_MAP
+(
+  USER_ID Integer NOT NULL,
+  ROLE_ID Integer NOT NULL,
+  PRIMARY KEY (USER_ID,ROLE_ID)
+);
+
+CREATE TABLE USERS_ROLE_PERMISSIONS
+(
+  ROLE_ID Integer NOT NULL,
+  PERM_NAME Varchar(30) NOT NULL,
+  PERM_VALUE Varchar(1) DEFAULT '',
+  PRIMARY KEY (ROLE_ID,PERM_NAME)
+);
+
+ALTER TABLE USERS_USERS ALTER DEFAULT_GROUP_ID TO DEFAULT_ROLE_ID;
+
+ALTER TABLE LIBERTY_CONTENT_ROLE_MAP ADD CONSTRAINT PROTECTOR_CONTENT_REF
+  FOREIGN KEY (CONTENT_ID) REFERENCES LIBERTY_CONTENT (CONTENT_ID);
+ALTER TABLE LIBERTY_CONTENT_ROLE_MAP ADD CONSTRAINT PROTECTOR_ROLE_REF
+  FOREIGN KEY (ROLE_ID) REFERENCES USERS_ROLES (ROLE_ID);
+  
+CREATE INDEX LIBERTY_CONTENT_PERM_ROLE_IDX ON LIBERTY_CONTENT_PERMISSIONS (ROLE_ID);
+
+ALTER TABLE LIBERTY_CONTENT_PERMISSIONS ADD CONSTRAINT LIBERTY_CONTENT_PERM_ROLE_REF
+  FOREIGN KEY (ROLE_ID) REFERENCES USERS_ROLES (ROLE_ID);
+
+ALTER TABLE USERS_ROLES ADD CONSTRAINT USERS_ROLES_USER_REF
+  FOREIGN KEY (USER_ID) REFERENCES USERS_USERS (USER_ID);
+CREATE INDEX USERS_ROLES_USER_IDX ON USERS_ROLES (USER_ID);
+CREATE UNIQUE INDEX USERS_ROLES_USER_NAME_IDX ON USERS_ROLES (USER_ID,ROLE_NAME);
+ALTER TABLE USERS_ROLES_MAP ADD CONSTRAINT USERS_ROLES_MAP_ROLE_REF
+  FOREIGN KEY (ROLE_ID) REFERENCES USERS_ROLES (ROLE_ID);
+ALTER TABLE USERS_ROLES_MAP ADD CONSTRAINT USERS_ROLES_MAP_USER_REF
+  FOREIGN KEY (USER_ID) REFERENCES USERS_USERS (USER_ID);
+CREATE INDEX USERS_ROLES_MAP_ROLE_IDX ON USERS_ROLES_MAP (ROLE_ID);
+CREATE INDEX USERS_ROLES_MAP_USER_IDX ON USERS_ROLES_MAP (USER_ID);
+ALTER TABLE USERS_ROLE_PERMISSIONS ADD CONSTRAINT USERS_ROLE_PERM_PERM_REF
+  FOREIGN KEY (PERM_NAME) REFERENCES USERS_PERMISSIONS (PERM_NAME);
+ALTER TABLE USERS_ROLE_PERMISSIONS ADD CONSTRAINT USERS_ROLE_PERM_ROLE_REF
+  FOREIGN KEY (ROLE_ID) REFERENCES USERS_ROLES (ROLE_ID);
+CREATE INDEX USERS_ROLE_PERM_PERM_IDX ON USERS_ROLE_PERMISSIONS (PERM_NAME);
+CREATE INDEX USERS_ROLE_PERM_ROLE_IDX ON USERS_ROLE_PERMISSIONS (ROLE_ID);
+
+GRANT DELETE, INSERT, REFERENCES, SELECT, UPDATE
+ ON LIBERTY_CONTENT_ROLE_MAP TO  SYSDBA WITH GRANT OPTION;
+ 
+GRANT DELETE, INSERT, REFERENCES, SELECT, UPDATE
+ ON USERS_PERMISSIONS TO  SYSDBA WITH GRANT OPTION;
+
+GRANT DELETE, INSERT, REFERENCES, SELECT, UPDATE
+ ON USERS_ROLES TO  SYSDBA WITH GRANT OPTION;
+
+GRANT DELETE, INSERT, REFERENCES, SELECT, UPDATE
+ ON USERS_ROLES_MAP TO  SYSDBA WITH GRANT OPTION;
+
+GRANT DELETE, INSERT, REFERENCES, SELECT, UPDATE
+ ON USERS_ROLE_PERMISSIONS TO  SYSDBA WITH GRANT OPTION;
+
+COMMIT;
+
+INSERT INTO USERS_ROLES
+SELECT * FROM USERS_GROUPS;
+
+INSERT INTO USERS_ROLES_MAP
+SELECT * FROM USERS_GROUPS_MAP;
+
+INSERT INTO USERS_ROLE_PERMISSIONS
+SELECT * FROM USERS_GROUP_PERMISSIONS;
+
+DROP TABLE USERS_GROUP_PERMISSIONS;
+DROP TABLE USERS_GROUPS_MAP;
+DROP TABLE USERS_GROUPS;
+DROP INDEX LIBERTY_CONTENT_PERM_GROUP_IDX;
+
+INSERT INTO USERS_PERMISSIONS (PERM_NAME, PERM_DESC, PERM_LEVEL, PACKAGE) VALUES ('p_users_assign_role_perms', 'Can assign permissions to personal roles', 'editors', 'users');
+INSERT INTO USERS_PERMISSIONS (PERM_NAME, PERM_DESC, PERM_LEVEL, PACKAGE) VALUES ('p_users_assign_role_members', 'Can assign users to personal roles', 'registered', 'users');
+INSERT INTO USERS_PERMISSIONS (PERM_NAME, PERM_DESC, PERM_LEVEL, PACKAGE) VALUES ('p_users_role_subroles', 'Can include other roles in roles', 'editors', 'users');
+INSERT INTO USERS_PERMISSIONS (PERM_NAME, PERM_DESC, PERM_LEVEL, PACKAGE) VALUES ('p_users_create_personal_roles', 'Can create personal user roles', 'editors', 'users');
+
+UPDATE USERS_ROLE_PERMISSIONS SET PERM_NAME = 'p_users_assign_role_members' WHERE PERM_NAME = 'p_users_assign_group_members';
+UPDATE USERS_ROLE_PERMISSIONS SET PERM_NAME = 'p_users_assign_role_perms' WHERE PERM_NAME = 'p_users_assign_group_perms';
+UPDATE USERS_ROLE_PERMISSIONS SET PERM_NAME = 'p_users_role_subroles' WHERE PERM_NAME = 'p_users_group_subgroups';
+UPDATE USERS_ROLE_PERMISSIONS SET PERM_NAME = 'p_users_create_personal_roles' WHERE PERM_NAME = 'p_users_create_personal_groups';
+UPDATE LIBERTY_CONTENT_PERMISSIONS SET PERM_NAME = 'p_users_assign_role_members' WHERE PERM_NAME = 'p_users_assign_group_members';
+UPDATE LIBERTY_CONTENT_PERMISSIONS SET PERM_NAME = 'p_users_assign_role_perms' WHERE PERM_NAME = 'p_users_assign_group_perms';
+UPDATE LIBERTY_CONTENT_PERMISSIONS SET PERM_NAME = 'p_users_role_subroles' WHERE PERM_NAME = 'p_users_group_subgroups';
+UPDATE LIBERTY_CONTENT_PERMISSIONS SET PERM_NAME = 'p_users_create_personal_roles' WHERE PERM_NAME = 'p_users_create_personal_groups';
+
+DELETE FROM USERS_PERMISSIONS WHERE PERM_NAME = 'p_users_assign_group_members';
+DELETE FROM USERS_PERMISSIONS WHERE PERM_NAME = 'p_users_assign_group_perms';
+DELETE FROM USERS_PERMISSIONS WHERE PERM_NAME = 'p_users_group_subgroups';
+DELETE FROM USERS_PERMISSIONS WHERE PERM_NAME = 'p_users_create_personal_groups';
+
+UPDATE KERNEL_CONFIG SET 
+CONFIG_NAME = 'protector_single_role', 
+PACKAGE = 'protector', 
+CONFIG_VALUE = 'y'
+WHERE CONFIG_NAME = 'protector_single_group';
\ No newline at end of file
diff --git a/admin/user_activity.php b/admin/user_activity.php
index 9893c2f..18a28a3 100644..100755
--- a/admin/user_activity.php
+++ b/admin/user_activity.php
@@ -1,12 +1,12 @@
 <?php
-
-require_once( '../../kernel/includes/setup_inc.php' );
+use Bitweaver\BitBase;
+require_once '../../kernel/includes/setup_inc.php';
 
 $gBitSystem->verifyPermission( 'p_users_admin' );
 
 $listHash = $_REQUEST;
 
-if( @BitBase::verifyId( $_REQUEST['user_id'] ) ) {
+if( BitBase::verifyId( $_REQUEST['user_id'] ?? 0 ) ) {
 	$listHash['user_id'] = $_REQUEST['user_id'];
 }
 
@@ -24,6 +24,6 @@ if( $userId = (int)BitBase::getParameter( $_REQUEST, 'user_id' ) ) {
 }
 
 $gBitSmarty->assign( 'userActivity', $gBitUser->getUserActivity( $listHash ));
-$gBitSmarty->assignByRef( 'listInfo', $listHash['listInfo'] );
+$gBitSmarty->assign( 'listInfo', $listHash['listInfo'] );
 $gBitSystem->display( 'bitpackage:users/user_activity.tpl', 'User Activity' , array( 'display_mode' => 'admin' ));
 
diff --git a/admin/users_import.php b/admin/users_import.php
index 60ab688..2dd7e2a 100644..100755
--- a/admin/users_import.php
+++ b/admin/users_import.php
@@ -8,7 +8,7 @@ require_once( '../../kernel/includes/setup_inc.php' );
 
 $gBitSystem->verifyPermission( 'p_users_admin' );
 
-$feedback = array();
+$feedback = [];
 
 if( isset( $_REQUEST["batchimport"])) {
 	// check if it's a batch upload
@@ -89,15 +89,23 @@ if( isset( $_REQUEST["batchimport"])) {
 		$gBitSmarty->assign( 'added', $added );
 		if( @is_array( $discarded ) ) {
 			$gBitSmarty->assign( 'discarded', count( $discarded ) );
-			$gBitSmarty->assignByRef( 'discardlist', $discarded );
+			$gBitSmarty->assign( 'discardlist', $discarded );
 		}
 	}
 }
 
-// get default group and pass it to tpl
-foreach( $gBitUser->getDefaultGroup() as $defaultGroupId => $defaultGroupName ) {
-	$gBitSmarty->assign('defaultGroupId', $defaultGroupId );
-	$gBitSmarty->assign('defaultGroupName', $defaultGroupName );
+if ( defined( 'ROLE_MODEL' ) ) {
+	// get default role and pass it to tpl
+	foreach( $gBitUser->getDefaultRole() as $defaultRoleId => $defaultRoleName ) {
+		$gBitSmarty->assign('defaultRoleId', $defaultRoleId );
+		$gBitSmarty->assign('defaultRoleName', $defaultRoleName );
+	}
+} else {
+	// get default group and pass it to tpl
+	foreach( $gBitUser->getDefaultGroup() as $defaultGroupId => $defaultGroupName ) {
+		$gBitSmarty->assign('defaultGroupId', $defaultGroupId );
+		$gBitSmarty->assign('defaultGroupName', $defaultGroupName );
+	}
 }
 
 // Display the template