-require_once (SM_PATH . 'include/validate.php');
-require_once (SM_PATH . 'functions/page_header.php');
-require_once (SM_PATH . 'plugins/change_password/functions.php');
-require_once (SM_PATH . 'plugins/change_password/config.php');
-require_once (SM_PATH . 'functions/forms.php');
+include_once (SM_PATH . 'plugins/change_password/functions.php');
+include_once (SM_PATH . 'functions/forms.php');
+
+/** load default config */
+if (file_exists(SM_PATH . 'plugins/change_password/config_default.php')) {
+ include_once (SM_PATH . 'plugins/change_password/config_default.php');
+} else {
+ // somebody decided to remove default config
+ $cpw_backend = 'template';
+ $cpw_pass_min_length = 4;
+ $cpw_pass_max_length = 25;
+ $cpw_require_ssl = FALSE;
+}
+
+/**
+ * prevent possible corruption of configuration overrides in
+ * register_globals=on and preloaded php scripts.
+ */
+$cpw_ldap=array();
+$cpw_merak=array();
+$cpw_mysql=array();
+$cpw_poppassd=array();
+$cpw_vmailmgrd=array();
+
+/** load site config */
+if (file_exists(SM_PATH . 'config/change_password_config.php')) {
+ include_once (SM_PATH . 'config/change_password_config.php');
+} elseif (file_exists(SM_PATH . 'plugins/change_password/config.php')) {
+ include_once (SM_PATH . 'plugins/change_password/config.php');
+}
+
+// must load backend libraries here in order to get working change_password_init hook.
+if (file_exists(SM_PATH . 'plugins/change_password/backend/'.$cpw_backend.'.php')) {
+ include_once(SM_PATH . 'plugins/change_password/backend/'.$cpw_backend.'.php');
+}