Enclose account settings panels in separate forms

- This prevents auto-filled password fields to abort settings save
- Move single-use settings/nick_set template HTML to settings/account

CHANGELOG

@@ -2,6 +2,8 @@ Version 2022.05 (unreleased)
   Friendica Core
 
   Friendica Addons
+    Breaking: The obsolete hooks settings_form and settings_post have been removed,
+         custom addons developers should use the addon_settings hook instead.
 
   Closed Issues
 

src/Module/Settings/Account.php

@@ -47,57 +47,17 @@ class Account extends BaseSettings
 			throw new HTTPException\ForbiddenException(DI::l10n()->t('Permission denied.'));
 		}
 
-		self::checkFormSecurityTokenRedirectOnError('/settings', 'settings');
+		$redirectUrl = '/settings' . (isset($this->parameters['open']) ? '/account/' . $this->parameters['open'] : '');
+
+		self::checkFormSecurityTokenRedirectOnError($redirectUrl, 'settings');
 
 		$a = DI::app();
 
 		$user = User::getById($a->getLoggedInUserId());
 
-		// Import Contacts from CSV file
+		if (!empty($request['password-submit'])) {
-		if (!empty($_POST['importcontact-submit'])) {
+			$newpass = $request['password'];
-			if (isset($_FILES['importcontact-filename'])) {
+			$confirm = $request['confirm'];
-				// was there an error
-				if ($_FILES['importcontact-filename']['error'] > 0) {
-					Logger::notice('Contact CSV file upload error', ['error' => $_FILES['importcontact-filename']['error']]);
-					notice(DI::l10n()->t('Contact CSV file upload error'));
-				} else {
-					$csvArray = array_map('str_getcsv', file($_FILES['importcontact-filename']['tmp_name']));
-					Logger::notice('Import started', ['lines' => count($csvArray)]);
-					// import contacts
-					foreach ($csvArray as $csvRow) {
-						// The 1st row may, or may not contain the headers of the table
-						// We expect the 1st field of the row to contain either the URL
-						// or the handle of the account, therefore we check for either
-						// "http" or "@" to be present in the string.
-						// All other fields from the row will be ignored
-						if ((strpos($csvRow[0],'@') !== false) || in_array(parse_url($csvRow[0], PHP_URL_SCHEME), ['http', 'https'])) {
-							Worker::add(PRIORITY_LOW, 'AddContact', $_SESSION['uid'], $csvRow[0]);
-						} else {
-							Logger::notice('Invalid account', ['url' => $csvRow[0]]);
-						}
-					}
-					Logger::notice('Import done');
-
-					info(DI::l10n()->t('Importing Contacts done'));
-					// delete temp file
-					unlink($_FILES['importcontact-filename']['tmp_name']);
-				}
-			} else {
-				Logger::notice('Import triggered, but no import file was found.');
-			}
-
-			return;
-		}
-
-		if (!empty($_POST['resend_relocate'])) {
-			Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::RELOCATION, local_user());
-			info(DI::l10n()->t("Relocate message has been send to your contacts"));
-			DI::baseUrl()->redirect('settings');
-		}
-
-		if (!empty($_POST['password']) || !empty($_POST['confirm'])) {
-			$newpass = $_POST['password'];
-			$confirm = $_POST['confirm'];
 
 			try {
 				if ($newpass != $confirm) {
@@ -105,7 +65,7 @@ class Account extends BaseSettings
 				}
 
 				//  check if the old password was supplied correctly before changing it to the new value
-				User::getIdFromPasswordAuthentication(local_user(), $_POST['opassword']);
+				User::getIdFromPasswordAuthentication(local_user(), $request['opassword']);
 
 				$result = User::updatePassword(local_user(), $newpass);
 				if (!DBA::isResult($result)) {
@@ -117,89 +77,17 @@ class Account extends BaseSettings
 				notice($e->getMessage());
 				notice(DI::l10n()->t('Password unchanged.'));
 			}
+
+			DI::baseUrl()->redirect($redirectUrl);
 		}
 
-		$username         = (!empty($_POST['username'])        ? trim($_POST['username'])          : '');
+		if (!empty($request['basic-submit'])) {
-		$email            = (!empty($_POST['email'])           ? trim($_POST['email'])             : '');
+			$username = trim($request['username'] ?? '');
-		$timezone         = (!empty($_POST['timezone'])        ? trim($_POST['timezone'])          : '');
+			$email    = trim($request['email'] ?? '');
-		$language         = (!empty($_POST['language'])        ? trim($_POST['language'])          : '');
+			$timezone = trim($request['timezone'] ?? '');
 
-		$defloc           = (!empty($_POST['defloc'])          ? trim($_POST['defloc'])            : '');
-		$maxreq           = (!empty($_POST['maxreq'])          ? intval($_POST['maxreq'])          : 0);
-		$expire           = (!empty($_POST['expire'])          ? intval($_POST['expire'])          : 0);
-		$def_gid          = (!empty($_POST['group-selection']) ? intval($_POST['group-selection']) : 0);
-
-
-		$expire_items     = (!empty($_POST['expire_items']) ? intval($_POST['expire_items'])	 : 0);
-		$expire_notes     = (!empty($_POST['expire_notes']) ? intval($_POST['expire_notes'])	 : 0);
-		$expire_starred   = (!empty($_POST['expire_starred']) ? intval($_POST['expire_starred']) : 0);
-		$expire_photos    = (!empty($_POST['expire_photos'])? intval($_POST['expire_photos'])	 : 0);
-		$expire_network_only    = (!empty($_POST['expire_network_only'])? intval($_POST['expire_network_only'])	 : 0);
-
-		$delete_openid    = ((!empty($_POST['delete_openid']) && (intval($_POST['delete_openid']) == 1)) ? 1: 0);
-
-		$allow_location   = ((!empty($_POST['allow_location']) && (intval($_POST['allow_location']) == 1)) ? 1: 0);
-		$publish          = ((!empty($_POST['profile_in_directory']) && (intval($_POST['profile_in_directory']) == 1)) ? 1: 0);
-		$net_publish      = ((!empty($_POST['profile_in_netdirectory']) && (intval($_POST['profile_in_netdirectory']) == 1)) ? 1: 0);
-		$account_type     = ((!empty($_POST['account-type']) && (intval($_POST['account-type']))) ? intval($_POST['account-type']) : 0);
-		$page_flags       = ((!empty($_POST['page-flags']) && (intval($_POST['page-flags']))) ? intval($_POST['page-flags']) : 0);
-		$blockwall        = ((!empty($_POST['blockwall']) && (intval($_POST['blockwall']) == 1)) ? 0: 1); // this setting is inverted!
-		$blocktags        = ((!empty($_POST['blocktags']) && (intval($_POST['blocktags']) == 1)) ? 0: 1); // this setting is inverted!
-		$unkmail          = ((!empty($_POST['unkmail']) && (intval($_POST['unkmail']) == 1)) ? 1: 0);
-		$cntunkmail       = (!empty($_POST['cntunkmail']) ? intval($_POST['cntunkmail']) : 0);
-		$hide_friends     = (($_POST['hide-friends'] == 1) ? 1: 0);
-		$hidewall         = (($_POST['hidewall'] == 1) ? 1: 0);
-		$unlisted         = (($_POST['unlisted'] == 1) ? 1: 0);
-		$accessiblephotos = (($_POST['accessible-photos'] == 1) ? 1: 0);
-
-		$notify_like      = (($_POST['notify_like'] == 1) ? 1 : 0);
-		$notify_announce  = (($_POST['notify_announce'] == 1) ? 1 : 0);
-
-		$email_textonly   = (($_POST['email_textonly'] == 1) ? 1 : 0);
-		$detailed_notif   = (($_POST['detailed_notif'] == 1) ? 1 : 0);
-
-		$notify_ignored   = (($_POST['notify_ignored'] == 1) ? 1 : 0);
-
-		$notify = 0;
-
-		if (!empty($_POST['notify1'])) {
-			$notify += intval($_POST['notify1']);
-		}
-		if (!empty($_POST['notify2'])) {
-			$notify += intval($_POST['notify2']);
-		}
-		if (!empty($_POST['notify3'])) {
-			$notify += intval($_POST['notify3']);
-		}
-		if (!empty($_POST['notify4'])) {
-			$notify += intval($_POST['notify4']);
-		}
-		if (!empty($_POST['notify5'])) {
-			$notify += intval($_POST['notify5']);
-		}
-		if (!empty($_POST['notify6'])) {
-			$notify += intval($_POST['notify6']);
-		}
-		if (!empty($_POST['notify7'])) {
-			$notify += intval($_POST['notify7']);
-		}
-		if (!empty($_POST['notify8'])) {
-			$notify += intval($_POST['notify8']);
-		}
-
-		// Adjust the page flag if the account type doesn't fit to the page flag.
-		if ($account_type == User::ACCOUNT_TYPE_PERSON && !in_array($page_flags, [User::PAGE_FLAGS_NORMAL, User::PAGE_FLAGS_SOAPBOX, User::PAGE_FLAGS_FREELOVE])) {
-			$page_flags = User::PAGE_FLAGS_NORMAL;
-		} elseif ($account_type == User::ACCOUNT_TYPE_ORGANISATION && $page_flags != User::PAGE_FLAGS_SOAPBOX) {
-			$page_flags = User::PAGE_FLAGS_SOAPBOX;
-		} elseif ($account_type == User::ACCOUNT_TYPE_NEWS && $page_flags != User::PAGE_FLAGS_SOAPBOX) {
-			$page_flags = User::PAGE_FLAGS_SOAPBOX;
-		} elseif ($account_type == User::ACCOUNT_TYPE_COMMUNITY && !in_array($page_flags, [User::PAGE_FLAGS_COMMUNITY, User::PAGE_FLAGS_PRVGROUP])) {
-			$page_flags = User::PAGE_FLAGS_COMMUNITY;
-		}
 
 			$err = '';
-
 			if ($username != $user['username']) {
 				if (strlen($username) > 40) {
 					$err .= DI::l10n()->t('Please use a shorter name.');
@@ -212,7 +100,7 @@ class Account extends BaseSettings
 			if ($email != $user['email']) {
 				//  check for the correct password
 				try {
-				User::getIdFromPasswordAuthentication(local_user(), $_POST['mpassword']);
+					User::getIdFromPasswordAuthentication(local_user(), $request['mpassword']);
 				} catch (Exception $ex) {
 					$err .= DI::l10n()->t('Wrong Password.');
 					$email = $user['email'];
@@ -236,23 +124,134 @@ class Account extends BaseSettings
 				return;
 			}
 
-		if (($timezone != $user['timezone']) && strlen($timezone)) {
+			if (strlen($timezone) && $timezone != $user['timezone']) {
 				$a->setTimeZone($timezone);
 			}
 
+			$fields = [
+				'username'         => $username,
+				'email'            => $email,
+				'timezone'         => $timezone,
+				'default-location' => trim($request['default_location'] ?? ''),
+				'allow_location'   => !empty($request['allow_location']),
+				'language'         => trim($request['language'] ?? ''),
+			];
+
+			if (!empty($request['delete_openid'])) {
+				$fields['openid']       = '';
+				$fields['openidserver'] = '';
+			}
+
+			if (!User::update($fields, local_user())) {
+				notice(DI::l10n()->t('Settings were not updated.'));
+			}
+
+			// clear session language
+			unset($_SESSION['language']);
+
+			DI::baseUrl()->redirect($redirectUrl);
+		}
+
+		if (!empty($request['privacy-submit'])) {
+			$maxreq       = intval($request['maxreq'] ?? 0);
+			$publish      = !empty($request['profile_in_directory']);
+			$net_publish  = !empty($request['profile_in_netdirectory']);
+			$hide_friends = !empty($request['hide-friends']);
+			$hidewall     = !empty($request['hidewall']);
+			$blockwall    = empty($request['blockwall']); // this setting is inverted!
+			$blocktags    = empty($request['blocktags']); // this setting is inverted!
+			$unkmail      = !empty($request['unkmail']);
+			$cntunkmail   = intval($request['cntunkmail'] ?? 0);
+			$def_gid      = intval($request['group-selection'] ?? 0);
+
 			$aclFormatter = DI::aclFormatter();
 
-		$str_group_allow   = !empty($_POST['group_allow'])   ? $aclFormatter->toString($_POST['group_allow'])   : '';
+			$str_group_allow   = !empty($request['group_allow']) ? $aclFormatter->toString($request['group_allow']) : '';
-		$str_contact_allow = !empty($_POST['contact_allow']) ? $aclFormatter->toString($_POST['contact_allow']) : '';
+			$str_contact_allow = !empty($request['contact_allow']) ? $aclFormatter->toString($request['contact_allow']) : '';
-		$str_group_deny    = !empty($_POST['group_deny'])    ? $aclFormatter->toString($_POST['group_deny'])    : '';
+			$str_group_deny    = !empty($request['group_deny']) ? $aclFormatter->toString($request['group_deny']) : '';
-		$str_contact_deny  = !empty($_POST['contact_deny'])  ? $aclFormatter->toString($_POST['contact_deny'])  : '';
+			$str_contact_deny  = !empty($request['contact_deny']) ? $aclFormatter->toString($request['contact_deny']) : '';
+
+			DI::pConfig()->set(local_user(), 'system', 'unlisted', !empty($request['unlisted']));
+			DI::pConfig()->set(local_user(), 'system', 'accessible-photos', !empty($request['accessible-photos']));
+
+			$fields = [
+				'allow_cid'  => $str_contact_allow,
+				'allow_gid'  => $str_group_allow,
+				'deny_cid'   => $str_contact_deny,
+				'deny_gid'   => $str_group_deny,
+				'maxreq'     => $maxreq,
+				'def_gid'    => $def_gid,
+				'blockwall'  => $blockwall,
+				'hidewall'   => $hidewall,
+				'blocktags'  => $blocktags,
+				'unkmail'    => $unkmail,
+				'cntunkmail' => $cntunkmail,
+			];
+
+			$profile_fields = [
+				'publish'      => $publish,
+				'net-publish'  => $net_publish,
+				'hide-friends' => $hide_friends
+			];
+
+			if (!User::update($fields, local_user()) || !Profile::update($profile_fields, local_user())) {
+				notice(DI::l10n()->t('Settings were not updated.'));
+			}
+
+			DI::baseUrl()->redirect($redirectUrl);
+		}
+
+		if (!empty($request['expire-submit'])) {
+			$expire = intval($request['expire'] ?? 0);
+
+			$expire_items        = !empty($request['expire_items']);
+			$expire_notes        = !empty($request['expire_notes']);
+			$expire_starred      = !empty($request['expire_starred']);
+			$expire_network_only = !empty($request['expire_network_only']);
 
 			DI::pConfig()->set(local_user(), 'expire', 'items', $expire_items);
 			DI::pConfig()->set(local_user(), 'expire', 'notes', $expire_notes);
 			DI::pConfig()->set(local_user(), 'expire', 'starred', $expire_starred);
-		DI::pConfig()->set(local_user(), 'expire', 'photos', $expire_photos);
 			DI::pConfig()->set(local_user(), 'expire', 'network_only', $expire_network_only);
 
+			if (!User::update(['expire' => $expire], local_user())) {
+				notice(DI::l10n()->t('Settings were not updated.'));
+			}
+
+			DI::baseUrl()->redirect($redirectUrl);
+		}
+
+		if (!empty($request['notification-submit'])) {
+			$notify = 0;
+
+			if (!empty($request['notify1'])) {
+				$notify += intval($request['notify1']);
+			}
+			if (!empty($request['notify2'])) {
+				$notify += intval($request['notify2']);
+			}
+			if (!empty($request['notify3'])) {
+				$notify += intval($request['notify3']);
+			}
+			if (!empty($request['notify4'])) {
+				$notify += intval($request['notify4']);
+			}
+			if (!empty($request['notify5'])) {
+				$notify += intval($request['notify5']);
+			}
+			if (!empty($request['notify6'])) {
+				$notify += intval($request['notify6']);
+			}
+			if (!empty($request['notify7'])) {
+				$notify += intval($request['notify7']);
+			}
+			if (!empty($request['notify8'])) {
+				$notify += intval($request['notify8']);
+			}
+
+			$notify_like     = !empty($request['notify_like']);
+			$notify_announce = !empty($request['notify_announce']);
+
 			// Reset like notifications when they are going to be shown again
 			if (!DI::pConfig()->get(local_user(), 'system', 'notify_like') && $notify_like) {
 				DI::notification()->setAllSeenForUser(local_user(), ['vid' => Verb::getID(Activity::LIKE)]);
@@ -267,50 +266,113 @@ class Account extends BaseSettings
 
 			DI::pConfig()->set(local_user(), 'system', 'notify_announce', $notify_announce);
 
-		DI::pConfig()->set(local_user(), 'system', 'email_textonly', $email_textonly);
+			DI::pConfig()->set(local_user(), 'system', 'email_textonly', !empty($request['email_textonly']));
-		DI::pConfig()->set(local_user(), 'system', 'detailed_notif', $detailed_notif);
+			DI::pConfig()->set(local_user(), 'system', 'detailed_notif', !empty($request['detailed_notif']));
-		DI::pConfig()->set(local_user(), 'system', 'notify_ignored', $notify_ignored);
+			DI::pConfig()->set(local_user(), 'system', 'notify_ignored', !empty($request['notify_ignored']));
-		DI::pConfig()->set(local_user(), 'system', 'unlisted', $unlisted);
-		DI::pConfig()->set(local_user(), 'system', 'accessible-photos', $accessiblephotos);
 
-		if ($account_type == User::ACCOUNT_TYPE_COMMUNITY) {
+			$fields = [
-			$str_group_allow   = '';
+				'notify-flags' => $notify,
-			$str_contact_allow = '';
+			];
-			$str_group_deny    = '';
-			$str_contact_deny  = '';
 
-			DI::pConfig()->set(local_user(), 'system', 'unlisted', true);
+			if (!User::update($fields, local_user())) {
-
-			$blockwall    = true;
-			$blocktags    = true;
-			$hide_friends = true;
-		}
-
-		if ($page_flags == User::PAGE_FLAGS_PRVGROUP) {
-			$str_group_allow = '<' . Group::FOLLOWERS . '>';
-		}
-
-		$fields = ['username' => $username, 'email' => $email, 'timezone' => $timezone,
-		           'allow_cid' => $str_contact_allow, 'allow_gid' => $str_group_allow, 'deny_cid' => $str_contact_deny, 'deny_gid' => $str_group_deny,
-		           'notify-flags' => $notify, 'page-flags' => $page_flags, 'account-type' => $account_type, 'default-location' => $defloc,
-		           'allow_location' => $allow_location, 'maxreq' => $maxreq, 'expire' => $expire, 'def_gid' => $def_gid, 'blockwall' => $blockwall,
-		           'hidewall' => $hidewall, 'blocktags' => $blocktags, 'unkmail' => $unkmail, 'cntunkmail' => $cntunkmail, 'language' => $language];
-
-		if ($delete_openid) {
-			$fields['openid'] = '';
-			$fields['openidserver'] = '';
-		}
-
-		$profile_fields = ['publish' => $publish, 'net-publish' => $net_publish, 'hide-friends' => $hide_friends];
-
-		if (!User::update($fields, local_user()) || !Profile::update($profile_fields, local_user())) {
 				notice(DI::l10n()->t('Settings were not updated.'));
 			}
 
-		// clear session language
+			DI::baseUrl()->redirect($redirectUrl);
-		unset($_SESSION['language']);
+		}
 
-		DI::baseUrl()->redirect('settings');
+		if (!empty($request['advanced-submit'])) {
+			$account_type = intval($request['account-type'] ?? 0);
+			$page_flags   = intval($request['page-flags'] ?? 0);
+
+			// Adjust the page flag if the account type doesn't fit to the page flag.
+			if ($account_type == User::ACCOUNT_TYPE_PERSON && !in_array($page_flags, [User::PAGE_FLAGS_NORMAL, User::PAGE_FLAGS_SOAPBOX, User::PAGE_FLAGS_FREELOVE])) {
+				$page_flags = User::PAGE_FLAGS_NORMAL;
+			} elseif ($account_type == User::ACCOUNT_TYPE_ORGANISATION && $page_flags != User::PAGE_FLAGS_SOAPBOX) {
+				$page_flags = User::PAGE_FLAGS_SOAPBOX;
+			} elseif ($account_type == User::ACCOUNT_TYPE_NEWS && $page_flags != User::PAGE_FLAGS_SOAPBOX) {
+				$page_flags = User::PAGE_FLAGS_SOAPBOX;
+			} elseif ($account_type == User::ACCOUNT_TYPE_COMMUNITY && !in_array($page_flags, [User::PAGE_FLAGS_COMMUNITY, User::PAGE_FLAGS_PRVGROUP])) {
+				$page_flags = User::PAGE_FLAGS_COMMUNITY;
+			}
+
+			$fields         = [];
+			$profile_fields = [];
+
+			if ($account_type == User::ACCOUNT_TYPE_COMMUNITY) {
+				DI::pConfig()->set(local_user(), 'system', 'unlisted', true);
+
+				$fields = [
+					'allow_cid' => '',
+					'allow_gid' => $page_flags == User::PAGE_FLAGS_PRVGROUP ?
+							'<' . Group::FOLLOWERS . '>'
+							: '',
+					'deny_cid'  => '',
+					'deny_gid'  => '',
+					'blockwall' => true,
+					'blocktags' => true,
+				];
+
+				$profile_fields = [
+					'hide-friends' => true,
+				];
+			}
+
+			$fields = array_merge($fields, [
+				'page-flags'   => $page_flags,
+				'account-type' => $account_type,
+			]);
+
+			if (!User::update($fields, local_user()) || !empty($profile_fields) && !Profile::update($profile_fields, local_user())) {
+				notice(DI::l10n()->t('Settings were not updated.'));
+			}
+
+			DI::baseUrl()->redirect($redirectUrl);
+		}
+
+		// Import Contacts from CSV file
+		if (!empty($request['importcontact-submit'])) {
+			if (isset($_FILES['importcontact-filename'])) {
+				// was there an error
+				if ($_FILES['importcontact-filename']['error'] > 0) {
+					Logger::notice('Contact CSV file upload error', ['error' => $_FILES['importcontact-filename']['error']]);
+					notice(DI::l10n()->t('Contact CSV file upload error'));
+				} else {
+					$csvArray = array_map('str_getcsv', file($_FILES['importcontact-filename']['tmp_name']));
+					Logger::notice('Import started', ['lines' => count($csvArray)]);
+					// import contacts
+					foreach ($csvArray as $csvRow) {
+						// The 1st row may, or may not contain the headers of the table
+						// We expect the 1st field of the row to contain either the URL
+						// or the handle of the account, therefore we check for either
+						// "http" or "@" to be present in the string.
+						// All other fields from the row will be ignored
+						if ((strpos($csvRow[0], '@') !== false) || in_array(parse_url($csvRow[0], PHP_URL_SCHEME), ['http', 'https'])) {
+							Worker::add(PRIORITY_LOW, 'AddContact', $_SESSION['uid'], $csvRow[0]);
+						} else {
+							Logger::notice('Invalid account', ['url' => $csvRow[0]]);
+						}
+					}
+					Logger::notice('Import done');
+
+					info(DI::l10n()->t('Importing Contacts done'));
+					// delete temp file
+					unlink($_FILES['importcontact-filename']['tmp_name']);
+				}
+			} else {
+				Logger::notice('Import triggered, but no import file was found.');
+			}
+
+			DI::baseUrl()->redirect($redirectUrl);
+		}
+
+		if (!empty($request['relocate-submit'])) {
+			Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::RELOCATION, local_user());
+			info(DI::l10n()->t("Relocate message has been send to your contacts"));
+			DI::baseUrl()->redirect($redirectUrl);
+		}
+
+		DI::baseUrl()->redirect($redirectUrl);
 	}
 
 	protected function content(array $request = []): string
@@ -337,17 +399,16 @@ class Account extends BaseSettings
 		$timezone         = $user['timezone'];
 		$language         = $user['language'];
 		$notify           = $user['notify-flags'];
-		$defloc     = $user['default-location'];
+		$default_location = $user['default-location'];
 		$openid           = $user['openid'];
 		$maxreq           = $user['maxreq'];
-		$expire     = (intval($user['expire'])) ? $user['expire'] : '';
+		$expire           = $user['expire'] ?: '';
 		$unkmail          = $user['unkmail'];
 		$cntunkmail       = $user['cntunkmail'];
 
 		$expire_items        = DI::pConfig()->get(local_user(), 'expire', 'items', true);
 		$expire_notes        = DI::pConfig()->get(local_user(), 'expire', 'notes', true);
 		$expire_starred      = DI::pConfig()->get(local_user(), 'expire', 'starred', true);
-		$expire_photos       = DI::pConfig()->get(local_user(), 'expire', 'photos', false);
 		$expire_network_only = DI::pConfig()->get(local_user(), 'expire', 'network_only', false);
 
 		if (!strlen($user['timezone'])) {
@@ -363,9 +424,7 @@ class Account extends BaseSettings
 			$user['account-type'] = User::ACCOUNT_TYPE_COMMUNITY;
 		}
 
-
 		$pageset_tpl = Renderer::getMarkupTemplate('settings/pagetypes.tpl');
-
 		$pagetype    = Renderer::replaceMacros($pageset_tpl, [
 			'$account_types'     => DI::l10n()->t("Account Types"),
 			'$user'              => DI::l10n()->t("Personal Page Subtypes"),
@@ -441,19 +500,18 @@ class Account extends BaseSettings
 		]);
 
 		$noid = DI::config()->get('system', 'no_openid');
-
 		if ($noid) {
 			$openid_field = false;
 		} else {
 			$openid_field = ['openid_url', DI::l10n()->t('OpenID:'), $openid, DI::l10n()->t("(Optional) Allow this OpenID to login to this account."), "", "readonly", "url"];
 		}
 
-		$opt_tpl = Renderer::getMarkupTemplate("field_checkbox.tpl");
 		if (DI::config()->get('system', 'publish_all')) {
 			$profile_in_dir = '<input type="hidden" name="profile_in_directory" value="1" />';
 		} else {
+			$opt_tpl        = Renderer::getMarkupTemplate("field_checkbox.tpl");
 			$profile_in_dir = Renderer::replaceMacros($opt_tpl, [
-				'$field' => ['profile_in_directory', DI::l10n()->t('Publish your profile in your local site directory?'), $profile['publish'], DI::l10n()->t('Your profile will be published in this node\'s <a href="%s">local directory</a>. Your profile details may be publicly visible depending on the system settings.', DI::baseUrl().'/directory')]
+				'$field' => ['profile_in_directory', DI::l10n()->t('Publish your profile in your local site directory?'), $profile['publish'], DI::l10n()->t('Your profile will be published in this node\'s <a href="%s">local directory</a>. Your profile details may be publicly visible depending on the system settings.', DI::baseUrl() . '/directory')]
 			]);
 		}
 
@@ -462,33 +520,25 @@ class Account extends BaseSettings
 			$net_pub_desc = ' ' . DI::l10n()->t('Your profile will also be published in the global friendica directories (e.g. <a href="%s">%s</a>).', DI::config()->get('system', 'directory'), DI::config()->get('system', 'directory'));
 		}
 
-		$tpl_addr = Renderer::getMarkupTemplate('settings/nick_set.tpl');
-
-		$prof_addr = Renderer::replaceMacros($tpl_addr,[
-			'$desc' => DI::l10n()->t("Your Identity Address is <strong>'%s'</strong> or '%s'.", $nickname . '@' . DI::baseUrl()->getHostname() . DI::baseUrl()->getUrlPath(), DI::baseUrl() . '/profile/' . $nickname),
-			'$basepath' => DI::baseUrl()->getHostname()
-		]);
-
-		$stpl = Renderer::getMarkupTemplate('settings/settings.tpl');
-
 		/* Installed langs */
 		$lang_choices = DI::l10n()->getAvailableLanguages();
 
-		/// @TODO Fix indending (or so)
+		$tpl = Renderer::getMarkupTemplate('settings/account.tpl');
-		$o = Renderer::replaceMacros($stpl, [
+		$o   = Renderer::replaceMacros($tpl, [
 			'$ptitle' => DI::l10n()->t('Account Settings'),
+			'$desc'   => DI::l10n()->t("Your Identity Address is <strong>'%s'</strong> or '%s'.", $nickname . '@' . DI::baseUrl()->getHostname() . DI::baseUrl()->getUrlPath(), DI::baseUrl() . '/profile/' . $nickname),
 
 			'$submit'              => DI::l10n()->t('Save Settings'),
 			'$baseurl'             => DI::baseUrl()->get(true),
 			'$uid'                 => local_user(),
 			'$form_security_token' => self::getFormSecurityToken('settings'),
-			'$nickname_block' => $prof_addr,
+			'$open'                => $this->parameters['open'] ?? 'password',
 
 			'$h_pass'        => DI::l10n()->t('Password Settings'),
-			'$password1'=> ['password', DI::l10n()->t('New Password:'), '', DI::l10n()->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).'), false, 'autocomplete="off"'],
+			'$password1'     => ['password', DI::l10n()->t('New Password:'), '', DI::l10n()->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).'), false, 'autocomplete="off"'],
-			'$password2'=> ['confirm', DI::l10n()->t('Confirm:'), '', DI::l10n()->t('Leave password fields blank unless changing'), false, 'autocomplete="off"'],
+			'$password2'     => ['confirm', DI::l10n()->t('Confirm:'), '', DI::l10n()->t('Leave password fields blank unless changing'), false, 'autocomplete="off"'],
-			'$password3'=> ['opassword', DI::l10n()->t('Current Password:'), '', DI::l10n()->t('Your current password to confirm the changes'), false, 'autocomplete="off"'],
+			'$password3'     => ['opassword', DI::l10n()->t('Current Password:'), '', DI::l10n()->t('Your current password to confirm the changes'), false, 'autocomplete="off"'],
-			'$password4'=> ['mpassword', DI::l10n()->t('Password:'), '', DI::l10n()->t('Your current password to confirm the changes of the email address'), false, 'autocomplete="off"'],
+			'$password4'     => ['mpassword', DI::l10n()->t('Password:'), '', DI::l10n()->t('Your current password to confirm the changes of the email address'), false, 'autocomplete="off"'],
 			'$oid_enable'    => (!DI::config()->get('system', 'no_openid')),
 			'$openid'        => $openid_field,
 			'$delete_openid' => ['delete_openid', DI::l10n()->t('Delete OpenID URL'), false, ''],
@@ -496,14 +546,14 @@ class Account extends BaseSettings
 			'$h_basic'          => DI::l10n()->t('Basic Settings'),
 			'$username'         => ['username', DI::l10n()->t('Full Name:'), $username, '', false, 'autocomplete="off"'],
 			'$email'            => ['email', DI::l10n()->t('Email Address:'), $email, '', '', 'autocomplete="off"', 'email'],
-			'$timezone' => ['timezone_select' , DI::l10n()->t('Your Timezone:'), Temporal::getTimezoneSelect($timezone), ''],
+			'$timezone'         => ['timezone_select', DI::l10n()->t('Your Timezone:'), Temporal::getTimezoneSelect($timezone), ''],
 			'$language'         => ['language', DI::l10n()->t('Your Language:'), $language, DI::l10n()->t('Set the language we use to show you friendica interface and to send you emails'), $lang_choices],
-			'$defloc'	=> ['defloc', DI::l10n()->t('Default Post Location:'), $defloc, ''],
+			'$default_location' => ['default_location', DI::l10n()->t('Default Post Location:'), $default_location, ''],
-			'$allowloc' => ['allow_location', DI::l10n()->t('Use Browser Location:'), ($user['allow_location'] == 1), ''],
+			'$allow_location'   => ['allow_location', DI::l10n()->t('Use Browser Location:'), ($user['allow_location'] == 1), ''],
 
 			'$h_prv'              => DI::l10n()->t('Security and Privacy Settings'),
 			'$is_community'       => ($user['account-type'] == User::ACCOUNT_TYPE_COMMUNITY),
-			'$maxreq' 	          => ['maxreq', DI::l10n()->t('Maximum Friend Requests/Day:'), $maxreq , DI::l10n()->t("(to prevent spam abuse)")],
+			'$maxreq'             => ['maxreq', DI::l10n()->t('Maximum Friend Requests/Day:'), $maxreq, DI::l10n()->t("(to prevent spam abuse)")],
 			'$profile_in_dir'     => $profile_in_dir,
 			'$profile_in_net_dir' => ['profile_in_netdirectory', DI::l10n()->t('Allow your profile to be searchable globally?'), $profile['net-publish'], DI::l10n()->t("Activate this setting if you want others to easily find and follow you. Your profile will be searchable on remote systems. This setting also determines whether Friendica will inform search engines that your profile should be indexed or not.") . $net_pub_desc],
 			'$hide_friends'       => ['hide-friends', DI::l10n()->t('Hide your contact/friend list from viewers of your profile?'), $profile['hide-friends'], DI::l10n()->t('A list of your contacts is displayed on your profile page. Activate this option to disable the display of your contact list.')],
@@ -513,7 +563,7 @@ class Account extends BaseSettings
 			'$blockwall'          => ['blockwall', DI::l10n()->t('Allow friends to post to your profile page?'), (intval($user['blockwall']) ? '0' : '1'), DI::l10n()->t('Your contacts may write posts on your profile wall. These posts will be distributed to your contacts')],
 			'$blocktags'          => ['blocktags', DI::l10n()->t('Allow friends to tag your posts?'), (intval($user['blocktags']) ? '0' : '1'), DI::l10n()->t('Your contacts can add additional tags to your posts.')],
 			'$unkmail'            => ['unkmail', DI::l10n()->t('Permit unknown people to send you private mail?'), $unkmail, DI::l10n()->t('Friendica network users may send you private messages even if they are not in your contact list.')],
-			'$cntunkmail' 	      => ['cntunkmail', DI::l10n()->t('Maximum private messages per day from unknown people:'), $cntunkmail , DI::l10n()->t("(to prevent spam abuse)")],
+			'$cntunkmail'         => ['cntunkmail', DI::l10n()->t('Maximum private messages per day from unknown people:'), $cntunkmail, DI::l10n()->t("(to prevent spam abuse)")],
 			'$group_select'       => Group::displayGroupSelection(local_user(), $user['def_gid']),
 			'$permissions'        => DI::l10n()->t('Default Post Permissions'),
 			'$aclselect'          => ACL::getFullSelectorHTML(DI::page(), $a->getLoggedInUserId()),
@@ -524,7 +574,6 @@ class Account extends BaseSettings
 				'items'        => ['expire_items', DI::l10n()->t('Expire posts'), $expire_items, DI::l10n()->t('When activated, posts and comments will be expired.')],
 				'notes'        => ['expire_notes', DI::l10n()->t('Expire personal notes'), $expire_notes, DI::l10n()->t('When activated, the personal notes on your profile page will be expired.')],
 				'starred'      => ['expire_starred', DI::l10n()->t('Expire starred posts'), $expire_starred, DI::l10n()->t('Starring posts keeps them from being expired. That behaviour is overwritten by this setting.')],
-				'photos'       => ['expire_photos', DI::l10n()->t('Expire photos'), $expire_photos, DI::l10n()->t('When activated, photos will be expired.')],
 				'network_only' => ['expire_network_only', DI::l10n()->t('Only expire posts by others'), $expire_network_only, DI::l10n()->t('When activated, your own posts never expire. Then the settings above are only valid for posts you received.')],
 			],
 
@@ -543,19 +592,26 @@ class Account extends BaseSettings
 			'$notify_like'     => ['notify_like', DI::l10n()->t('Someone liked your content'), DI::pConfig()->get(local_user(), 'system', 'notify_like'), ''],
 			'$notify_announce' => ['notify_announce', DI::l10n()->t('Someone shared your content'), DI::pConfig()->get(local_user(), 'system', 'notify_announce'), ''],
 
-			'$desktop_notifications' => ['desktop_notifications', DI::l10n()->t('Activate desktop notifications') , false, DI::l10n()->t('Show desktop popup on new notifications')],
+			'$desktop_notifications' => ['desktop_notifications', DI::l10n()->t('Activate desktop notifications'), false, DI::l10n()->t('Show desktop popup on new notifications')],
 
-			'$email_textonly' => ['email_textonly', DI::l10n()->t('Text-only notification emails'),
+			'$email_textonly' => [
+				'email_textonly',
+				DI::l10n()->t('Text-only notification emails'),
 				DI::pConfig()->get(local_user(), 'system', 'email_textonly'),
-			                      DI::l10n()->t('Send text only notification emails, without the html part')],
+				DI::l10n()->t('Send text only notification emails, without the html part')
-
+			],
-			'$detailed_notif' => ['detailed_notif', DI::l10n()->t('Show detailled notifications'),
+			'$detailed_notif' => [
+				'detailed_notif',
+				DI::l10n()->t('Show detailled notifications'),
 				DI::pConfig()->get(local_user(), 'system', 'detailed_notif'),
-			                      DI::l10n()->t('Per default, notifications are condensed to a single notification per item. When enabled every notification is displayed.')],
+				DI::l10n()->t('Per default, notifications are condensed to a single notification per item. When enabled every notification is displayed.')
-
+			],
-			'$notify_ignored' => ['notify_ignored', DI::l10n()->t('Show notifications of ignored contacts') ,
+			'$notify_ignored' => [
+				'notify_ignored',
+				DI::l10n()->t('Show notifications of ignored contacts'),
 				DI::pConfig()->get(local_user(), 'system', 'notify_ignored', true),
-			                      DI::l10n()->t("You don't see posts from ignored contacts. But you still see their comments. This setting controls if you want to still receive regular notifications that are caused by ignored contacts or not.")],
+				DI::l10n()->t("You don't see posts from ignored contacts. But you still see their comments. This setting controls if you want to still receive regular notifications that are caused by ignored contacts or not.")
+			],
 
 			'$h_advn'     => DI::l10n()->t('Advanced Account/Page Type Settings'),
 			'$h_descadvn' => DI::l10n()->t('Change the behaviour of this account for special situations'),
@@ -565,6 +621,7 @@ class Account extends BaseSettings
 			'$importcontact_text'    => DI::l10n()->t('Upload a CSV file that contains the handle of your followed accounts in the first column you exported from the old account.'),
 			'$importcontact_button'  => DI::l10n()->t('Upload File'),
 			'$importcontact_maxsize' => DI::config()->get('system', 'max_csv_file_size', 30720),
+
 			'$relocate'        => DI::l10n()->t('Relocate'),
 			'$relocate_text'   => DI::l10n()->t("If you have moved this profile from another server, and some of your contacts don't receive your updates, try pushing this button."),
 			'$relocate_button' => DI::l10n()->t("Resend relocate message to contacts"),

static/routes.config.php

@@ -545,6 +545,10 @@ return [
 
 	'/settings' => [
 		'[/]'         => [Module\Settings\Account::class,               [R::GET, R::POST]],
+		'/account' => [
+			'[/]'     => [Module\Settings\Account::class,               [R::GET, R::POST]],
+			'/{open}' => [Module\Settings\Account::class,               [R::GET, R::POST]],
+		],
 		'/2fa' => [
 			'[/]'           => [Module\Settings\TwoFactor\Index::class,       [R::GET, R::POST]],
 			'/recovery'     => [Module\Settings\TwoFactor\Recovery::class,    [R::GET, R::POST]],

view/templates/settings/account.tpl

@@ -1,44 +1,48 @@
 <h1>{{$ptitle}}</h1>
 
-{{$nickname_block nofilter}}
+<div id="settings-nick-wrapper">
-
+	<div id="settings-nickname-desc" class="info-message">{{$desc nofilter}}</div>
-<form action="settings" id="settings-form" method="post" autocomplete="off" enctype="multipart/form-data">
+</div>
-	<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+<div id="settings-nick-end"></div>
 
+<div id="settings-form">
 	<h2 class="settings-heading"><a href="javascript:;">{{$h_pass}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 		{{include file="field_password.tpl" field=$password1}}
 		{{include file="field_password.tpl" field=$password2}}
 		{{include file="field_password.tpl" field=$password3}}
 
-		{{if $oid_enable}}
-			{{include file="field_input.tpl" field=$openid}}
-		{{/if}}
-
 		<div class="settings-submit-wrapper">
-			<input type="submit" name="submit" class="settings-submit" value="{{$submit}}"/>
+			<input type="submit" name="password-submit" class="settings-submit" value="{{$submit}}"/>
-		</div>
 		</div>
+	</form>
 
 	<h2 class="settings-heading"><a href="javascript:;">{{$h_basic}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
-
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 		{{include file="field_input.tpl" field=$username}}
 		{{include file="field_input.tpl" field=$email}}
 		{{include file="field_password.tpl" field=$password4}}
+
+		{{if $oid_enable}}
+			{{include file="field_input.tpl" field=$openid}}
+			{{include file="field_checkbox.tpl" field=$delete_openid}}
+		{{/if}}
+
 		{{include file="field_custom.tpl" field=$timezone}}
 		{{include file="field_select.tpl" field=$language}}
-		{{include file="field_input.tpl" field=$defloc}}
+		{{include file="field_input.tpl" field=$default_location}}
-		{{include file="field_checkbox.tpl" field=$allowloc}}
+		{{include file="field_checkbox.tpl" field=$allow_location}}
-
 
 		<div class="settings-submit-wrapper">
-			<input type="submit" name="submit" class="settings-submit" value="{{$submit}}"/>
+			<input type="submit" name="basic-submit" class="settings-submit" value="{{$submit}}"/>
-		</div>
 		</div>
+	</form>
 
 	<h2 class="settings-heading"><a href="javascript:;">{{$h_prv}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 		{{include file="field_input.tpl" field=$maxreq}}
 
 		{{$profile_in_dir nofilter}}
@@ -62,12 +66,13 @@
 		{{$aclselect nofilter}}
 		{{/if}}
 		<div class="settings-submit-wrapper">
-			<input type="submit" name="submit" class="settings-submit" value="{{$submit}}"/>
+			<input type="submit" name="privacy-submit" class="settings-submit" value="{{$submit}}"/>
-		</div>
 		</div>
+	</form>
 
 	<h2 class="settings-heading"><a href="javascript:;">{{$expire.label}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 		<div id="settings-expiry">
 			{{include file="field_input.tpl" field=$expire.days}}
 			{{include file="field_checkbox.tpl" field=$expire.items}}
@@ -76,13 +81,14 @@
 			{{include file="field_checkbox.tpl" field=$expire.network_only}}
 
 			<div class="settings-submit-wrapper">
-				<input type="submit" name="submit" class="settings-submit" value="{{$submit}}"/>
+				<input type="submit" name="expire-submit" class="settings-submit" value="{{$submit}}"/>
-			</div>
 			</div>
 		</div>
+	</form>
 
 	<h2 class="settings-heading"><a href="javascript:;">{{$h_not}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 		<div id="settings-notifications">
 
 			<div id="settings-notification-desc">{{$lbl_not}}</div>
@@ -147,37 +153,41 @@
 		</div>
 
 		<div class="settings-submit-wrapper">
-			<input type="submit" name="submit" class="settings-submit" value="{{$submit}}"/>
+			<input type="submit" name="notification-submit" class="settings-submit" value="{{$submit}}"/>
-		</div>
 		</div>
+	</form>
 
 	<h2 class="settings-heading"><a href="javascript:;">{{$h_advn}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
-		<div id="settings-pagetype-desc">{{$h_descadvn}}</div>
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+		<p id="settings-advanced-desc">{{$h_descadvn}}</p>
 
 		{{$pagetype nofilter}}
 
 		<div class="settings-submit-wrapper">
-			<input type="submit" name="submit" class="settings-submit" value="{{$submit}}"/>
+			<input type="submit" name="advanced-submit" class="settings-submit" value="{{$submit}}"/>
-		</div>
 		</div>
+	</form>
 
 	<h2 class="settings-heading"><a href="javascript:;">{{$importcontact}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 		<input type="hidden" name="MAX_FILE_SIZE" value="{{$importcontact_maxsize}}"/>
-		<div id="settings-pagetype-desc">{{$importcontact_text}}</div>
+		<p id="settings-pagetype-desc">{{$importcontact_text}}</p>
-		<input type="file" name="importcontact-filename"/>
+		<p><input type="file" name="importcontact-filename"/></p>
 
 		<div class="settings-submit-wrapper">
 			<input type="submit" name="importcontact-submit" class="importcontact-submit" value="{{$importcontact_button}}"/>
 		</div>
-	</div>
+	</form>
 
 	<h2 class="settings-heading"><a href="javascript:;">{{$relocate}}</a></h2>
-	<div class="settings-content-block">
+	<form class="settings-content-block" action="settings" method="post" autocomplete="off" enctype="multipart/form-data">
-		<div id="settings-pagetype-desc">{{$relocate_text}}</div>
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+		<p id="settings-pagetype-desc">{{$relocate_text}}</p>
 
 		<div class="settings-submit-wrapper">
-			<input type="submit" name="resend_relocate" class="settings-submit" value="{{$relocate_button}}"/>
+			<input type="submit" name="relocate-submit" class="settings-submit" value="{{$relocate_button}}"/>
-		</div>
 		</div>
+	</form>
+</div>

view/templates/settings/nick_set.tpl

@@ -1,5 +0,0 @@
-
-<div id="settings-nick-wrapper">
-	<div id="settings-nickname-desc" class="info-message">{{$desc nofilter}}</div>
-</div>
-<div id="settings-nick-end"></div>

view/theme/frio/templates/settings/account.tpl

@@ -1,74 +1,79 @@
 <div class="generic-page-wrapper">
 	<h1>{{$ptitle}}</h1>
 
-	{{$nickname_block nofilter}}
+	<div id="settings-nick-wrapper">
-
+		<div id="settings-nickname-desc" class="info-message">{{$desc nofilter}}</div>
-	<form action="settings" id="settings-form" method="post" autocomplete="off" enctype="multipart/form-data">
+	</div>
-		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+	<div id="settings-nick-end"></div>
 
+	<div id="settings-form">
 		{{* We organize the settings in collapsable panel-groups *}}
 		<div class="panel-group panel-group-settings" id="settings" role="tablist" aria-multiselectable="true">
 			{{* The password setting section *}}
-			<div class="panel">
+			<form action="settings/account/password" method="post" autocomplete="off" class="panel" >
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 				<div class="section-subtitle-wrapper panel-heading" role="tab" id="password-settings">
 					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#password-settings-collapse" aria-expanded="false" aria-controls="password-settings-collapse">
+						<button class="btn-link accordion-toggle{{if $open !== 'password'}} collapsed{{/if}}" data-toggle="collapse" data-parent="#settings" href="#password-settings-collapse" aria-expanded="false" aria-controls="password-settings-collapse">
 							{{$h_pass}}
 						</button>
 					</h2>
 				</div>
-				<div id="password-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="password-settings">
+				<div id="password-settings-collapse" class="panel-collapse collapse{{if $open == 'password'}} in{{/if}}" role="tabpanel" aria-labelledby="password-settings">
 					<div class="panel-body">
 						{{include file="field_password.tpl" field=$password1}}
 						{{include file="field_password.tpl" field=$password2}}
 						{{include file="field_password.tpl" field=$password3}}
+					</div>
+					<div class="panel-footer">
+						<button type="submit" name="password-submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
+					</div>
+				</div>
+			</form>
+
+			{{* The basic setting section *}}
+			<form action="settings/account/basic" method="post" autocomplete="off" class="panel">
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+				<div class="section-subtitle-wrapper panel-heading" role="tab" id="basic-settings">
+					<h2>
+						<button class="btn-link accordion-toggle{{if $open !== 'basic'}} collapsed{{/if}}" data-toggle="collapse" data-parent="#settings" href="#basic-settings-collapse" aria-expanded="false" aria-controls="basic-settings-collapse">
+							{{$h_basic}}
+						</button>
+					</h2>
+				</div>
+				<div id="basic-settings-collapse" class="panel-collapse collapse{{if $open == 'basic'}} in{{/if}}" role="tabpanel" aria-labelledby="basic-settings">
+					<div class="panel-body">
+						{{include file="field_input.tpl" field=$username}}
+						{{include file="field_input.tpl" field=$email}}
+						{{include file="field_password.tpl" field=$password4}}
 
 						{{if $oid_enable}}
 							{{include file="field_input.tpl" field=$openid}}
 							{{include file="field_checkbox.tpl" field=$delete_openid}}
 						{{/if}}
-					</div>
-					<div class="panel-footer">
-						<button type="submit" name="submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
-					</div>
-				</div>
-			</div>
 
-			{{* The basic setting section *}}
-			<div class="panel">
-				<div class="section-subtitle-wrapper panel-heading" role="tab" id="basic-settings">
-					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#basic-settings-collapse" aria-expanded="false" aria-controls="basic-settings-collapse">
-							{{$h_basic}}
-						</button>
-					</h2>
-				</div>
-				<div id="basic-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="basic-settings">
-					<div class="panel-body">
-						{{include file="field_input.tpl" field=$username}}
-						{{include file="field_input.tpl" field=$email}}
-						{{include file="field_password.tpl" field=$password4}}
 						{{include file="field_custom.tpl" field=$timezone}}
 						{{include file="field_select.tpl" field=$language}}
-						{{include file="field_input.tpl" field=$defloc}}
+						{{include file="field_input.tpl" field=$default_location}}
-						{{include file="field_checkbox.tpl" field=$allowloc}}
+						{{include file="field_checkbox.tpl" field=$allow_location}}
 					</div>
 					<div class="panel-footer">
-						<button type="submit" name="submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
+						<button type="submit" name="basic-submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
-					</div>
 					</div>
 				</div>
+			</form>
 
 			{{* The privacity setting section *}}
-			<div class="panel">
+			<form action="settings/account/privacy" method="post" autocomplete="off" class="panel">
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 				<div class="section-subtitle-wrapper panel-heading" role="tab" id="privacy-settings">
 					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#privacy-settings-collapse" aria-expanded="false" aria-controls="privacy-settings-collapse">
+						<button class="btn-link accordion-toggle{{if $open !== 'privacy'}} collapsed{{/if}}" data-toggle="collapse" data-parent="#settings" href="#privacy-settings-collapse" aria-expanded="false" aria-controls="privacy-settings-collapse">
 							{{$h_prv}}
 						</button>
 					</h2>
 				</div>
-				<div id="privacy-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="privacy-settings">
+				<div id="privacy-settings-collapse" class="panel-collapse collapse{{if $open == 'privacy'}} in{{/if}}" role="tabpanel" aria-labelledby="privacy-settings">
 					<div class="panel-body">
 						{{include file="field_input.tpl" field=$maxreq}}
 
@@ -95,20 +100,21 @@
 						{{/if}}
 					</div>
 					<div class="panel-footer">
-						<button type="submit" name="submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
+						<button type="submit" name="privacy-submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
-					</div>
 					</div>
 				</div>
+			</form>
 
-			<div class="panel">
+			<form action="settings/account/expire" method="post" autocomplete="off" class="panel">
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 				<div class="section-subtitle-wrapper panel-heading" role="tab" id="expire-settings">
 					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#expire-settings-collapse" aria-expanded="false" aria-controls="expire-settings-collapse">
+						<button class="btn-link accordion-toggle{{if $open !== 'expire'}} collapsed{{/if}}" data-toggle="collapse" data-parent="#settings" href="#expire-settings-collapse" aria-expanded="false" aria-controls="expire-settings-collapse">
 							{{$expire.label}}
 						</button>
 					</h2>
 				</div>
-				<div id="expire-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="expire-settings">
+				<div id="expire-settings-collapse" class="panel-collapse collapse{{if $open == 'expire'}} in{{/if}}" role="tabpanel" aria-labelledby="expire-settings">
 					<div class="panel-body">
 						{{include file="field_input.tpl" field=$expire.days}}
 
@@ -118,21 +124,22 @@
 						{{include file="field_checkbox.tpl" field=$expire.network_only}}
 					</div>
 					<div class="panel-footer">
-						<button type="submit" name="submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
+						<button type="submit" name="expire-submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
-					</div>
 					</div>
 				</div>
+			</form>
 
 			{{* The notification setting section *}}
-			<div class="panel">
+			<form action="settings/account/notification" method="post" autocomplete="off" class="panel">
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 				<div class="section-subtitle-wrapper panel-heading" role="tab" id="notification-settings">
 					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#notification-settings-collapse" aria-expanded="false" aria-controls="notification-settings-collapse">
+						<button class="btn-link accordion-toggle{{if $open !== 'notification'}} collapsed{{/if}}" data-toggle="collapse" data-parent="#settings" href="#notification-settings-collapse" aria-expanded="false" aria-controls="notification-settings-collapse">
 							{{$h_not}}
 						</button>
 					</h2>
 				</div>
-				<div id="notification-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="notification-settings">
+				<div id="notification-settings-collapse" class="panel-collapse collapse{{if $open == 'notification'}} in{{/if}}" role="tabpanel" aria-labelledby="notification-settings">
 					<div id="settings-notifications" class="panel-body">
 
 						<div id="settings-notification-desc">{{$lbl_not}}</div>
@@ -202,42 +209,44 @@
 						</script>
 					</div>
 					<div class="panel-footer">
-						<button type="submit" name="submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
+						<button type="submit" name="notification-submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
-					</div>
 					</div>
 				</div>
+			</form>
 
 			{{* The additional account setting section *}}
-			<div class="panel">
+			<form action="settings/account/advanced" method="post" autocomplete="off" class="panel">
-				<div class="section-subtitle-wrapper panel-heading" role="tab" id="additional-account-settings">
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+				<div class="section-subtitle-wrapper panel-heading" role="tab" id="advanced-account-settings">
 					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#additional-account-settings-collapse" aria-expanded="false" aria-controls="additional-account-settings-collapse">
+						<button class="btn-link accordion-toggle{{if $open !== 'advanced'}} collapsed{{/if}}" data-toggle="collapse" data-parent="#settings" href="#advanced-account-settings-collapse" aria-expanded="false" aria-controls="advanced-account-settings-collapse">
 							{{$h_advn}}
 						</button>
 					</h2>
 				</div>
-				<div id="additional-account-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="additional-account-settings">
+				<div id="advanced-account-settings-collapse" class="panel-collapse collapse{{if $open == 'advanced'}} in{{/if}}" role="tabpanel" aria-labelledby="advanced-account-settings">
 					<div class="panel-body">
 						<div id="settings-pagetype-desc">{{$h_descadvn}}</div>
 
 						{{$pagetype nofilter}}
 					</div>
 					<div class="panel-footer">
-						<button type="submit" name="submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
+						<button type="submit" name="advanced-submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
-					</div>
 					</div>
 				</div>
+			</form>
 
 			{{* Import contacts CSV *}}
-			<div class="panel">
+			<form action="settings/account/importcontact" method="post" autocomplete="off" class="panel">
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 				<div class="section-subtitle-wrapper panel-heading" role="tab" id="importcontact-settings">
 					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#importcontact-settings-collapse" aria-expanded="false" aria-controls="importcontact-settings-collapse">
+						<button class="btn-link accordion-toggle{{if $open !== 'importcontact'}} collapsed{{/if}}" data-toggle="collapse" data-parent="#settings" href="#importcontact-settings-collapse" aria-expanded="false" aria-controls="importcontact-settings-collapse">
 							{{$importcontact}}
 						</button>
 					</h2>
 				</div>
-				<div id="importcontact-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="importcontact-settings">
+				<div id="importcontact-settings-collapse" class="panel-collapse collapse{{if $open == 'importcontact'}} in{{/if}}" role="tabpanel" aria-labelledby="importcontact-settings">
 					<div class="panel-body">
 						<div id="importcontact-relocate-desc">{{$importcontact_text}}</div>
 						<input type="hidden" name="MAX_FILE_SIZE" value="{{$importcontact_maxsize}}" />
@@ -247,26 +256,27 @@
 						<button type="submit" name="importcontact-submit" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
 					</div>
 				</div>
-			</div>
+			</form>
 
 			{{* The relocate setting section *}}
-			<div class="panel">
+			<form action="settings/account/relocate" method="post" autocomplete="off" class="panel">
+				<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
 				<div class="section-subtitle-wrapper panel-heading" role="tab" id="relocate-settings">
 					<h2>
-						<button class="btn-link accordion-toggle collapsed" data-toggle="collapse" data-parent="#settings" href="#relocate-settings-collapse" aria-expanded="false" aria-controls="relocate-settings-collapse">
+						<button class="btn-link accordion-toggle" data-toggle="collapse" data-parent="#settings" href="#relocate-settings-collapse" aria-expanded="false" aria-controls="relocate-settings-collapse">
 							{{$relocate}}
 						</button>
 					</h2>
 				</div>
-				<div id="relocate-settings-collapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="relocate-settings">
+				<div id="relocate-settings-collapse" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="relocate-settings">
 					<div class="panel-body">
 						<div id="settings-relocate-desc">{{$relocate_text}}</div>
 					</div>
 					<div class="panel-footer">
-						<button type="submit" name="resend_relocate" class="btn btn-primary" value="{{$submit}}">{{$submit}}</button>
+						<button type="submit" name="relocate-submit" class="btn btn-primary" value="{{$relocate_button}}">{{$relocate_button}}</button>
-					</div>
-				</div>
 					</div>
 				</div>
 			</form>
+		</div>
+	</div>
 </div>