3 * @copyright Copyright (C) 2020, Friendica
5 * @license GNU AGPL version 3 or any later version
7 * This program is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU Affero General Public License as
9 * published by the Free Software Foundation, either version 3 of the
10 * License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Affero General Public License for more details.
17 * You should have received a copy of the GNU Affero General Public License
18 * along with this program. If not, see <https://www.gnu.org/licenses/>.
22 namespace Friendica\Model;
24 use DivineOmega\DOFileCachePSR6\CacheItemPool;
25 use DivineOmega\PasswordExposed;
28 use Friendica\Content\Pager;
29 use Friendica\Core\Hook;
30 use Friendica\Core\L10n;
31 use Friendica\Core\Logger;
32 use Friendica\Core\Protocol;
33 use Friendica\Core\System;
34 use Friendica\Core\Worker;
35 use Friendica\Database\DBA;
37 use Friendica\Model\TwoFactor\AppSpecificPassword;
38 use Friendica\Network\HTTPException;
39 use Friendica\Object\Image;
40 use Friendica\Util\Crypto;
41 use Friendica\Util\DateTimeFormat;
42 use Friendica\Util\Images;
43 use Friendica\Util\Network;
44 use Friendica\Util\Strings;
45 use Friendica\Worker\Delivery;
50 * This class handles User related functions
57 * PAGE_FLAGS_NORMAL is a typical personal profile account
58 * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
59 * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
60 * write access to wall and comments (no email and not included in page owner's ACL lists)
61 * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
65 const PAGE_FLAGS_NORMAL = 0;
66 const PAGE_FLAGS_SOAPBOX = 1;
67 const PAGE_FLAGS_COMMUNITY = 2;
68 const PAGE_FLAGS_FREELOVE = 3;
69 const PAGE_FLAGS_BLOG = 4;
70 const PAGE_FLAGS_PRVGROUP = 5;
78 * ACCOUNT_TYPE_PERSON - the account belongs to a person
79 * Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
81 * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
82 * Associated page type: PAGE_FLAGS_SOAPBOX
84 * ACCOUNT_TYPE_NEWS - the account is a news reflector
85 * Associated page type: PAGE_FLAGS_SOAPBOX
87 * ACCOUNT_TYPE_COMMUNITY - the account is community forum
88 * Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
90 * ACCOUNT_TYPE_RELAY - the account is a relay
91 * This will only be assigned to contacts, not to user accounts
94 const ACCOUNT_TYPE_PERSON = 0;
95 const ACCOUNT_TYPE_ORGANISATION = 1;
96 const ACCOUNT_TYPE_NEWS = 2;
97 const ACCOUNT_TYPE_COMMUNITY = 3;
98 const ACCOUNT_TYPE_RELAY = 4;
103 private static $owner;
106 * Returns the numeric account type by their string
108 * @param string $accounttype as string constant
109 * @return int|null Numeric account type - or null when not set
111 public static function getAccountTypeByString(string $accounttype)
113 switch ($accounttype) {
115 return User::ACCOUNT_TYPE_PERSON;
117 return User::ACCOUNT_TYPE_ORGANISATION;
119 return User::ACCOUNT_TYPE_NEWS;
121 return User::ACCOUNT_TYPE_COMMUNITY;
129 * Fetch the system account
131 * @return array system account
133 public static function getSystemAccount()
135 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
136 if (!DBA::isResult($system)) {
137 self::createSystemAccount();
138 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
139 if (!DBA::isResult($system)) {
144 $system['sprvkey'] = $system['uprvkey'] = $system['prvkey'];
145 $system['spubkey'] = $system['upubkey'] = $system['pubkey'];
146 $system['nickname'] = $system['nick'];
148 // Ensure that the user contains data
149 $user = DBA::selectFirst('user', ['prvkey'], ['uid' => 0]);
150 if (empty($user['prvkey'])) {
152 'username' => $system['name'],
153 'nickname' => $system['nick'],
154 'register_date' => $system['created'],
155 'pubkey' => $system['pubkey'],
156 'prvkey' => $system['prvkey'],
157 'spubkey' => $system['spubkey'],
158 'sprvkey' => $system['sprvkey'],
160 'page-flags' => User::PAGE_FLAGS_SOAPBOX,
161 'account-type' => User::ACCOUNT_TYPE_RELAY,
164 DBA::update('user', $fields, ['uid' => 0]);
171 * Create the system account
175 private static function createSystemAccount()
177 $system_actor_name = self::getActorName();
178 if (empty($system_actor_name)) {
182 $keys = Crypto::newKeypair(4096);
183 if ($keys === false) {
184 throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
189 $system['created'] = DateTimeFormat::utcNow();
190 $system['self'] = true;
191 $system['network'] = Protocol::ACTIVITYPUB;
192 $system['name'] = 'System Account';
193 $system['addr'] = $system_actor_name . '@' . DI::baseUrl()->getHostname();
194 $system['nick'] = $system_actor_name;
195 $system['avatar'] = DI::baseUrl() . Contact::DEFAULT_AVATAR_PHOTO;
196 $system['photo'] = DI::baseUrl() . Contact::DEFAULT_AVATAR_PHOTO;
197 $system['thumb'] = DI::baseUrl() . Contact::DEFAULT_AVATAR_THUMB;
198 $system['micro'] = DI::baseUrl() . Contact::DEFAULT_AVATAR_MICRO;
199 $system['url'] = DI::baseUrl() . '/friendica';
200 $system['nurl'] = Strings::normaliseLink($system['url']);
201 $system['pubkey'] = $keys['pubkey'];
202 $system['prvkey'] = $keys['prvkey'];
203 $system['blocked'] = 0;
204 $system['pending'] = 0;
205 $system['contact-type'] = Contact::TYPE_RELAY; // In AP this is translated to 'Application'
206 $system['name-date'] = DateTimeFormat::utcNow();
207 $system['uri-date'] = DateTimeFormat::utcNow();
208 $system['avatar-date'] = DateTimeFormat::utcNow();
209 $system['closeness'] = 0;
210 $system['baseurl'] = DI::baseUrl();
211 $system['gsid'] = GServer::getID($system['baseurl']);
212 DBA::insert('contact', $system);
216 * Detect a usable actor name
218 * @return string actor account name
220 public static function getActorName()
222 $system_actor_name = DI::config()->get('system', 'actor_name');
223 if (!empty($system_actor_name)) {
224 $self = Contact::selectFirst(['nick'], ['uid' => 0, 'self' => true]);
225 if (!empty($self['nick'])) {
226 if ($self['nick'] != $system_actor_name) {
227 // Reset the actor name to the already used name
228 DI::config()->set('system', 'actor_name', $self['nick']);
229 $system_actor_name = $self['nick'];
232 return $system_actor_name;
235 // List of possible actor names
236 $possible_accounts = ['friendica', 'actor', 'system', 'internal'];
237 foreach ($possible_accounts as $name) {
238 if (!DBA::exists('user', ['nickname' => $name, 'account_removed' => false, 'expire' => false]) &&
239 !DBA::exists('userd', ['username' => $name])) {
240 DI::config()->set('system', 'actor_name', $name);
248 * Returns true if a user record exists with the provided id
250 * @param integer $uid
254 public static function exists($uid)
256 return DBA::exists('user', ['uid' => $uid]);
260 * @param integer $uid
261 * @param array $fields
262 * @return array|boolean User record if it exists, false otherwise
265 public static function getById($uid, array $fields = [])
267 return !empty($uid) ? DBA::selectFirst('user', $fields, ['uid' => $uid]) : [];
271 * Returns a user record based on it's GUID
273 * @param string $guid The guid of the user
274 * @param array $fields The fields to retrieve
275 * @param bool $active True, if only active records are searched
277 * @return array|boolean User record if it exists, false otherwise
280 public static function getByGuid(string $guid, array $fields = [], bool $active = true)
283 $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
285 $cond = ['guid' => $guid];
288 return DBA::selectFirst('user', $fields, $cond);
292 * @param string $nickname
293 * @param array $fields
294 * @return array|boolean User record if it exists, false otherwise
297 public static function getByNickname($nickname, array $fields = [])
299 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
303 * Returns the user id of a given profile URL
307 * @return integer user id
310 public static function getIdForURL(string $url)
312 // Avoid any database requests when the hostname isn't even part of the url.
313 if (!strpos($url, DI::baseUrl()->getHostname())) {
317 $self = Contact::selectFirst(['uid'], ['self' => true, 'nurl' => Strings::normaliseLink($url)]);
318 if (!empty($self['uid'])) {
322 $self = Contact::selectFirst(['uid'], ['self' => true, 'addr' => $url]);
323 if (!empty($self['uid'])) {
327 $self = Contact::selectFirst(['uid'], ['self' => true, 'alias' => [$url, Strings::normaliseLink($url)]]);
328 if (!empty($self['uid'])) {
336 * Get a user based on its email
338 * @param string $email
339 * @param array $fields
341 * @return array|boolean User record if it exists, false otherwise
345 public static function getByEmail($email, array $fields = [])
347 return DBA::selectFirst('user', $fields, ['email' => $email]);
351 * Fetch the user array of the administrator. The first one if there are several.
353 * @param array $fields
356 public static function getFirstAdmin(array $fields = [])
358 if (!empty(DI::config()->get('config', 'admin_nickname'))) {
359 return self::getByNickname(DI::config()->get('config', 'admin_nickname'), $fields);
360 } elseif (!empty(DI::config()->get('config', 'admin_email'))) {
361 $adminList = explode(',', str_replace(' ', '', DI::config()->get('config', 'admin_email')));
362 return self::getByEmail($adminList[0], $fields);
369 * Get owner data by user id
372 * @param boolean $check_valid Test if data is invalid and correct it
373 * @return boolean|array
376 public static function getOwnerDataById(int $uid, bool $check_valid = true)
379 return self::getSystemAccount();
382 if (!empty(self::$owner[$uid])) {
383 return self::$owner[$uid];
386 $owner = DBA::selectFirst('owner-view', [], ['uid' => $uid]);
387 if (!DBA::isResult($owner)) {
388 if (!DBA::exists('user', ['uid' => $uid]) || !$check_valid) {
391 Contact::createSelfFromUserId($uid);
392 $owner = self::getOwnerDataById($uid, false);
395 if (empty($owner['nickname'])) {
403 // Check if the returned data is valid, otherwise fix it. See issue #6122
405 // Check for correct url and normalised nurl
406 $url = DI::baseUrl() . '/profile/' . $owner['nickname'];
407 $repair = ($owner['url'] != $url) || ($owner['nurl'] != Strings::normaliseLink($owner['url']));
410 // Check if "addr" is present and correct
411 $addr = $owner['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
412 $repair = ($addr != $owner['addr']) || empty($owner['prvkey']) || empty($owner['pubkey']);
416 // Check if the avatar field is filled and the photo directs to the correct path
417 $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
418 if (DBA::isResult($avatar)) {
419 $repair = empty($owner['avatar']) || !strpos($owner['photo'], $avatar['resource-id']);
424 Contact::updateSelfFromUserID($uid);
425 // Return the corrected data and avoid a loop
426 $owner = self::getOwnerDataById($uid, false);
429 self::$owner[$uid] = $owner;
434 * Get owner data by nick name
437 * @return boolean|array
440 public static function getOwnerDataByNick($nick)
442 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
444 if (!DBA::isResult($user)) {
448 return self::getOwnerDataById($user['uid']);
452 * Returns the default group for a given user and network
454 * @param int $uid User id
455 * @param string $network network name
457 * @return int group id
460 public static function getDefaultGroup($uid, $network = '')
464 if ($network == Protocol::OSTATUS) {
465 $default_group = DI::pConfig()->get($uid, "ostatus", "default_group");
468 if ($default_group != 0) {
469 return $default_group;
472 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
474 if (DBA::isResult($user)) {
475 $default_group = $user["def_gid"];
478 return $default_group;
483 * Authenticate a user with a clear text password
485 * @param mixed $user_info
486 * @param string $password
487 * @param bool $third_party
488 * @return int|boolean
489 * @deprecated since version 3.6
490 * @see User::getIdFromPasswordAuthentication()
492 public static function authenticate($user_info, $password, $third_party = false)
495 return self::getIdFromPasswordAuthentication($user_info, $password, $third_party);
496 } catch (Exception $ex) {
502 * Authenticate a user with a clear text password
504 * Returns the user id associated with a successful password authentication
506 * @param mixed $user_info
507 * @param string $password
508 * @param bool $third_party
509 * @return int User Id if authentication is successful
510 * @throws HTTPException\ForbiddenException
511 * @throws HTTPException\NotFoundException
513 public static function getIdFromPasswordAuthentication($user_info, $password, $third_party = false)
515 $user = self::getAuthenticationInfo($user_info);
517 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
518 // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
519 if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
522 } elseif (strpos($user['password'], '$') === false) {
523 //Legacy hash that has not been replaced by a new hash yet
524 if (self::hashPasswordLegacy($password) === $user['password']) {
525 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
529 } elseif (!empty($user['legacy_password'])) {
530 //Legacy hash that has been double-hashed and not replaced by a new hash yet
531 //Warning: `legacy_password` is not necessary in sync with the content of `password`
532 if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
533 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
537 } elseif (password_verify($password, $user['password'])) {
539 if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
540 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
546 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
550 * Returns authentication info from various parameters types
552 * User info can be any of the following:
555 * - User email or username or nickname
556 * - User array with at least the uid and the hashed password
558 * @param mixed $user_info
560 * @throws HTTPException\NotFoundException
562 public static function getAuthenticationInfo($user_info)
566 if (is_object($user_info) || is_array($user_info)) {
567 if (is_object($user_info)) {
568 $user = (array) $user_info;
575 || !isset($user['password'])
576 || !isset($user['legacy_password'])
578 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
580 } elseif (is_int($user_info) || is_string($user_info)) {
581 if (is_int($user_info)) {
582 $user = DBA::selectFirst(
584 ['uid', 'password', 'legacy_password'],
588 'account_expired' => 0,
589 'account_removed' => 0,
594 $fields = ['uid', 'password', 'legacy_password'];
596 "(`email` = ? OR `username` = ? OR `nickname` = ?)
597 AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
598 $user_info, $user_info, $user_info
600 $user = DBA::selectFirst('user', $fields, $condition);
603 if (!DBA::isResult($user)) {
604 throw new HTTPException\NotFoundException(DI::l10n()->t('User not found'));
612 * Generates a human-readable random password
617 public static function generateNewPassword()
619 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
623 * Checks if the provided plaintext password has been exposed or not
625 * @param string $password
629 public static function isPasswordExposed($password)
631 $cache = new CacheItemPool();
632 $cache->changeConfig([
633 'cacheDirectory' => get_temppath() . '/password-exposed-cache/',
637 $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
639 return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
640 } catch (Exception $e) {
641 Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
642 'code' => $e->getCode(),
643 'file' => $e->getFile(),
644 'line' => $e->getLine(),
645 'trace' => $e->getTraceAsString()
653 * Legacy hashing function, kept for password migration purposes
655 * @param string $password
658 private static function hashPasswordLegacy($password)
660 return hash('whirlpool', $password);
664 * Global user password hashing function
666 * @param string $password
670 public static function hashPassword($password)
672 if (!trim($password)) {
673 throw new Exception(DI::l10n()->t('Password can\'t be empty'));
676 return password_hash($password, PASSWORD_DEFAULT);
680 * Updates a user row with a new plaintext password
683 * @param string $password
687 public static function updatePassword($uid, $password)
689 $password = trim($password);
691 if (empty($password)) {
692 throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
695 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
696 throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
699 $allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
701 if (!preg_match('/^[a-z0-9' . preg_quote($allowed_characters, '/') . ']+$/i', $password)) {
702 throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
705 return self::updatePasswordHashed($uid, self::hashPassword($password));
709 * Updates a user row with a new hashed password.
710 * Empties the password reset token field just in case.
713 * @param string $pasword_hashed
717 private static function updatePasswordHashed($uid, $pasword_hashed)
720 'password' => $pasword_hashed,
722 'pwdreset_time' => null,
723 'legacy_password' => false
725 return DBA::update('user', $fields, ['uid' => $uid]);
729 * Checks if a nickname is in the list of the forbidden nicknames
731 * Check if a nickname is forbidden from registration on the node by the
732 * admin. Forbidden nicknames (e.g. role namess) can be configured in the
735 * @param string $nickname The nickname that should be checked
736 * @return boolean True is the nickname is blocked on the node
738 public static function isNicknameBlocked($nickname)
740 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
741 if (!empty($forbidden_nicknames)) {
742 $forbidden = explode(',', $forbidden_nicknames);
743 $forbidden = array_map('trim', $forbidden);
748 // Add the name of the internal actor to the "forbidden" list
749 $actor_name = self::getActorName();
750 if (!empty($actor_name)) {
751 $forbidden[] = $actor_name;
754 if (empty($forbidden)) {
758 // check if the nickname is in the list of blocked nicknames
759 if (in_array(strtolower($nickname), $forbidden)) {
768 * Catch-all user creation function
770 * Creates a user from the provided data array, either form fields or OpenID.
771 * Required: { username, nickname, email } or { openid_url }
773 * Performs the following:
774 * - Sends to the OpenId auth URL (if relevant)
775 * - Creates new key pairs for crypto
776 * - Create self-contact
777 * - Create profile image
781 * @throws ErrorException
782 * @throws HTTPException\InternalServerErrorException
783 * @throws ImagickException
786 public static function create(array $data)
788 $return = ['user' => null, 'password' => ''];
790 $using_invites = DI::config()->get('system', 'invitation_only');
792 $invite_id = !empty($data['invite_id']) ? Strings::escapeTags(trim($data['invite_id'])) : '';
793 $username = !empty($data['username']) ? Strings::escapeTags(trim($data['username'])) : '';
794 $nickname = !empty($data['nickname']) ? Strings::escapeTags(trim($data['nickname'])) : '';
795 $email = !empty($data['email']) ? Strings::escapeTags(trim($data['email'])) : '';
796 $openid_url = !empty($data['openid_url']) ? Strings::escapeTags(trim($data['openid_url'])) : '';
797 $photo = !empty($data['photo']) ? Strings::escapeTags(trim($data['photo'])) : '';
798 $password = !empty($data['password']) ? trim($data['password']) : '';
799 $password1 = !empty($data['password1']) ? trim($data['password1']) : '';
800 $confirm = !empty($data['confirm']) ? trim($data['confirm']) : '';
801 $blocked = !empty($data['blocked']);
802 $verified = !empty($data['verified']);
803 $language = !empty($data['language']) ? Strings::escapeTags(trim($data['language'])) : 'en';
805 $netpublish = $publish = !empty($data['profile_publish_reg']);
807 if ($password1 != $confirm) {
808 throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
809 } elseif ($password1 != '') {
810 $password = $password1;
813 if ($using_invites) {
815 throw new Exception(DI::l10n()->t('An invitation is required.'));
818 if (!Register::existsByHash($invite_id)) {
819 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
823 /// @todo Check if this part is really needed. We should have fetched all this data in advance
824 if (empty($username) || empty($email) || empty($nickname)) {
826 if (!Network::isUrlValid($openid_url)) {
827 throw new Exception(DI::l10n()->t('Invalid OpenID url'));
829 $_SESSION['register'] = 1;
830 $_SESSION['openid'] = $openid_url;
832 $openid = new LightOpenID(DI::baseUrl()->getHostname());
833 $openid->identity = $openid_url;
834 $openid->returnUrl = DI::baseUrl() . '/openid';
835 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
836 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
838 $authurl = $openid->authUrl();
839 } catch (Exception $e) {
840 throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . EOL . EOL . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
842 System::externalRedirect($authurl);
846 throw new Exception(DI::l10n()->t('Please enter the required information.'));
849 if (!Network::isUrlValid($openid_url)) {
853 // collapse multiple spaces in name
854 $username = preg_replace('/ +/', ' ', $username);
856 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
857 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
859 if ($username_min_length > $username_max_length) {
860 Logger::log(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length), Logger::WARNING);
861 $tmp = $username_min_length;
862 $username_min_length = $username_max_length;
863 $username_max_length = $tmp;
866 if (mb_strlen($username) < $username_min_length) {
867 throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
870 if (mb_strlen($username) > $username_max_length) {
871 throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
874 // So now we are just looking for a space in the full name.
875 $loose_reg = DI::config()->get('system', 'no_regfullname');
877 $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
878 if (strpos($username, ' ') === false) {
879 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
883 if (!Network::isEmailDomainAllowed($email)) {
884 throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
887 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
888 throw new Exception(DI::l10n()->t('Not a valid email address.'));
890 if (self::isNicknameBlocked($nickname)) {
891 throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
894 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
895 throw new Exception(DI::l10n()->t('Cannot use that email.'));
898 // Disallow somebody creating an account using openid that uses the admin email address,
899 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
900 if (DI::config()->get('config', 'admin_email') && strlen($openid_url)) {
901 $adminlist = explode(',', str_replace(' ', '', strtolower(DI::config()->get('config', 'admin_email'))));
902 if (in_array(strtolower($email), $adminlist)) {
903 throw new Exception(DI::l10n()->t('Cannot use that email.'));
907 $nickname = $data['nickname'] = strtolower($nickname);
909 if (!preg_match('/^[a-z0-9][a-z0-9_]*$/', $nickname)) {
910 throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
913 // Check existing and deleted accounts for this nickname.
915 DBA::exists('user', ['nickname' => $nickname])
916 || DBA::exists('userd', ['username' => $nickname])
918 throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
921 $new_password = strlen($password) ? $password : User::generateNewPassword();
922 $new_password_encoded = self::hashPassword($new_password);
924 $return['password'] = $new_password;
926 $keys = Crypto::newKeypair(4096);
927 if ($keys === false) {
928 throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
931 $prvkey = $keys['prvkey'];
932 $pubkey = $keys['pubkey'];
934 // Create another keypair for signing/verifying salmon protocol messages.
935 $sres = Crypto::newKeypair(512);
936 $sprvkey = $sres['prvkey'];
937 $spubkey = $sres['pubkey'];
939 $insert_result = DBA::insert('user', [
940 'guid' => System::createUUID(),
941 'username' => $username,
942 'password' => $new_password_encoded,
944 'openid' => $openid_url,
945 'nickname' => $nickname,
948 'spubkey' => $spubkey,
949 'sprvkey' => $sprvkey,
950 'verified' => $verified,
951 'blocked' => $blocked,
952 'language' => $language,
954 'register_date' => DateTimeFormat::utcNow(),
955 'default-location' => ''
958 if ($insert_result) {
959 $uid = DBA::lastInsertId();
960 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
962 throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
966 throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
969 // if somebody clicked submit twice very quickly, they could end up with two accounts
970 // due to race condition. Remove this one.
971 $user_count = DBA::count('user', ['nickname' => $nickname]);
972 if ($user_count > 1) {
973 DBA::delete('user', ['uid' => $uid]);
975 throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
978 $insert_result = DBA::insert('profile', [
981 'photo' => DI::baseUrl() . "/photo/profile/{$uid}.jpg",
982 'thumb' => DI::baseUrl() . "/photo/avatar/{$uid}.jpg",
983 'publish' => $publish,
984 'net-publish' => $netpublish,
986 if (!$insert_result) {
987 DBA::delete('user', ['uid' => $uid]);
989 throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
992 // Create the self contact
993 if (!Contact::createSelfFromUserId($uid)) {
994 DBA::delete('user', ['uid' => $uid]);
996 throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
999 // Create a group with no members. This allows somebody to use it
1000 // right away as a default group for new contacts.
1001 $def_gid = Group::create($uid, DI::l10n()->t('Friends'));
1003 DBA::delete('user', ['uid' => $uid]);
1005 throw new Exception(DI::l10n()->t('An error occurred creating your default contact group. Please try again.'));
1008 $fields = ['def_gid' => $def_gid];
1009 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
1010 $fields['allow_gid'] = '<' . $def_gid . '>';
1013 DBA::update('user', $fields, ['uid' => $uid]);
1015 // if we have no OpenID photo try to look up an avatar
1016 if (!strlen($photo)) {
1017 $photo = Network::lookupAvatarByEmail($email);
1020 // unless there is no avatar-addon loaded
1021 if (strlen($photo)) {
1022 $photo_failure = false;
1024 $filename = basename($photo);
1025 $curlResult = DI::httpRequest()->get($photo);
1026 if ($curlResult->isSuccess()) {
1027 $img_str = $curlResult->getBody();
1028 $type = $curlResult->getContentType();
1034 $type = Images::getMimeTypeByData($img_str, $photo, $type);
1036 $Image = new Image($img_str, $type);
1037 if ($Image->isValid()) {
1038 $Image->scaleToSquare(300);
1040 $resource_id = Photo::newResource();
1042 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 4);
1045 $photo_failure = true;
1048 $Image->scaleDown(80);
1050 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 5);
1053 $photo_failure = true;
1056 $Image->scaleDown(48);
1058 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 6);
1061 $photo_failure = true;
1064 if (!$photo_failure) {
1065 Photo::update(['profile' => 1], ['resource-id' => $resource_id]);
1070 Hook::callAll('register_account', $uid);
1072 $return['user'] = $user;
1077 * Sets block state for a given user
1079 * @param int $uid The user id
1080 * @param bool $block Block state (default is true)
1082 * @return bool True, if successfully blocked
1086 public static function block(int $uid, bool $block = true)
1088 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
1092 * Allows a registration based on a hash
1094 * @param string $hash
1096 * @return bool True, if the allow was successful
1098 * @throws HTTPException\InternalServerErrorException
1101 public static function allow(string $hash)
1103 $register = Register::getByHash($hash);
1104 if (!DBA::isResult($register)) {
1108 $user = User::getById($register['uid']);
1109 if (!DBA::isResult($user)) {
1113 Register::deleteByHash($hash);
1115 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
1117 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
1119 if (DBA::isResult($profile) && $profile['net-publish'] && DI::config()->get('system', 'directory')) {
1120 $url = DI::baseUrl() . '/profile/' . $user['nickname'];
1121 Worker::add(PRIORITY_LOW, "Directory", $url);
1124 $l10n = DI::l10n()->withLang($register['language']);
1126 return User::sendRegisterOpenEmail(
1129 DI::config()->get('config', 'sitename'),
1130 DI::baseUrl()->get(),
1131 ($register['password'] ?? '') ?: 'Sent in a previous email'
1136 * Denys a pending registration
1138 * @param string $hash The hash of the pending user
1140 * This does not have to go through user_remove() and save the nickname
1141 * permanently against re-registration, as the person was not yet
1142 * allowed to have friends on this system
1144 * @return bool True, if the deny was successfull
1147 public static function deny(string $hash)
1149 $register = Register::getByHash($hash);
1150 if (!DBA::isResult($register)) {
1154 $user = User::getById($register['uid']);
1155 if (!DBA::isResult($user)) {
1159 return DBA::delete('user', ['uid' => $register['uid']]) &&
1160 Register::deleteByHash($register['hash']);
1164 * Creates a new user based on a minimal set and sends an email to this user
1166 * @param string $name The user's name
1167 * @param string $email The user's email address
1168 * @param string $nick The user's nick name
1169 * @param string $lang The user's language (default is english)
1171 * @return bool True, if the user was created successfully
1172 * @throws HTTPException\InternalServerErrorException
1173 * @throws ErrorException
1174 * @throws ImagickException
1176 public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT)
1181 throw new HTTPException\InternalServerErrorException('Invalid arguments.');
1184 $result = self::create([
1185 'username' => $name,
1187 'nickname' => $nick,
1192 $user = $result['user'];
1193 $preamble = Strings::deindent(DI::l10n()->t('
1195 the administrator of %2$s has set up an account for you.'));
1196 $body = Strings::deindent(DI::l10n()->t('
1197 The login details are as follows:
1203 You may change your password from your account "Settings" page after logging
1206 Please take a few moments to review the other account settings on that page.
1208 You may also wish to add some basic information to your default profile
1209 (on the "Profiles" page) so that other people can easily find you.
1211 We recommend setting your full name, adding a profile photo,
1212 adding some profile "keywords" (very useful in making new friends) - and
1213 perhaps what country you live in; if you do not wish to be more specific
1216 We fully respect your right to privacy, and none of these items are necessary.
1217 If you are new and do not know anybody here, they may help
1218 you to make some new and interesting friends.
1220 If you ever want to delete your account, you can do so at %1$s/removeme
1222 Thank you and welcome to %4$s.'));
1224 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1225 $body = sprintf($body, DI::baseUrl()->get(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1227 $email = DI::emailer()
1229 ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1231 ->withRecipient($user['email'])
1233 return DI::emailer()->send($email);
1237 * Sends pending registration confirmation email
1239 * @param array $user User record array
1240 * @param string $sitename
1241 * @param string $siteurl
1242 * @param string $password Plaintext password
1243 * @return NULL|boolean from notification() and email() inherited
1244 * @throws HTTPException\InternalServerErrorException
1246 public static function sendRegisterPendingEmail($user, $sitename, $siteurl, $password)
1248 $body = Strings::deindent(DI::l10n()->t(
1251 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1253 Your login details are as follows:
1266 $email = DI::emailer()
1268 ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1270 ->withRecipient($user['email'])
1272 return DI::emailer()->send($email);
1276 * Sends registration confirmation
1278 * It's here as a function because the mail is sent from different parts
1280 * @param L10n $l10n The used language
1281 * @param array $user User record array
1282 * @param string $sitename
1283 * @param string $siteurl
1284 * @param string $password Plaintext password
1286 * @return NULL|boolean from notification() and email() inherited
1287 * @throws HTTPException\InternalServerErrorException
1289 public static function sendRegisterOpenEmail(L10n $l10n, $user, $sitename, $siteurl, $password)
1291 $preamble = Strings::deindent($l10n->t(
1294 Thank you for registering at %2$s. Your account has been created.
1299 $body = Strings::deindent($l10n->t(
1301 The login details are as follows:
1307 You may change your password from your account "Settings" page after logging
1310 Please take a few moments to review the other account settings on that page.
1312 You may also wish to add some basic information to your default profile
1313 ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1315 We recommend setting your full name, adding a profile photo,
1316 adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1317 perhaps what country you live in; if you do not wish to be more specific
1320 We fully respect your right to privacy, and none of these items are necessary.
1321 If you are new and do not know anybody here, they may help
1322 you to make some new and interesting friends.
1324 If you ever want to delete your account, you can do so at %3$s/removeme
1326 Thank you and welcome to %2$s.',
1334 $email = DI::emailer()
1336 ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1338 ->withRecipient($user['email'])
1340 return DI::emailer()->send($email);
1344 * @param int $uid user to remove
1346 * @throws HTTPException\InternalServerErrorException
1348 public static function remove(int $uid)
1354 Logger::log('Removing user: ' . $uid);
1356 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1358 Hook::callAll('remove_user', $user);
1360 // save username (actually the nickname as it is guaranteed
1361 // unique), so it cannot be re-registered in the future.
1362 DBA::insert('userd', ['username' => $user['nickname']]);
1364 // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
1365 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1366 Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1368 // Send an update to the directory
1369 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1370 Worker::add(PRIORITY_LOW, 'Directory', $self['url']);
1372 // Remove the user relevant data
1373 Worker::add(PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1379 * Return all identities to a user
1381 * @param int $uid The user id
1382 * @return array All identities for this user
1384 * Example for a return:
1388 * 'username' => 'maxmuster',
1389 * 'nickname' => 'Max Mustermann'
1393 * 'username' => 'johndoe',
1394 * 'nickname' => 'John Doe'
1399 public static function identities($uid)
1403 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1404 if (!DBA::isResult($user)) {
1408 if ($user['parent-uid'] == 0) {
1409 // First add our own entry
1411 'uid' => $user['uid'],
1412 'username' => $user['username'],
1413 'nickname' => $user['nickname']
1416 // Then add all the children
1419 ['uid', 'username', 'nickname'],
1420 ['parent-uid' => $user['uid'], 'account_removed' => false]
1422 if (DBA::isResult($r)) {
1423 $identities = array_merge($identities, DBA::toArray($r));
1426 // First entry is our parent
1429 ['uid', 'username', 'nickname'],
1430 ['uid' => $user['parent-uid'], 'account_removed' => false]
1432 if (DBA::isResult($r)) {
1433 $identities = DBA::toArray($r);
1436 // Then add all siblings
1439 ['uid', 'username', 'nickname'],
1440 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1442 if (DBA::isResult($r)) {
1443 $identities = array_merge($identities, DBA::toArray($r));
1448 "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1450 INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1451 WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1454 if (DBA::isResult($r)) {
1455 $identities = array_merge($identities, DBA::toArray($r));
1462 * Returns statistical information about the current users of this node
1468 public static function getStatistics()
1472 'active_users_halfyear' => 0,
1473 'active_users_monthly' => 0,
1474 'active_users_weekly' => 0,
1477 $userStmt = DBA::select('owner-view', ['uid', 'login_date', 'last-item'],
1478 ["`verified` AND `login_date` > ? AND NOT `blocked`
1479 AND NOT `account_removed` AND NOT `account_expired`",
1480 DBA::NULL_DATETIME]);
1481 if (!DBA::isResult($userStmt)) {
1485 $halfyear = time() - (180 * 24 * 60 * 60);
1486 $month = time() - (30 * 24 * 60 * 60);
1487 $week = time() - (7 * 24 * 60 * 60);
1489 while ($user = DBA::fetch($userStmt)) {
1490 $statistics['total_users']++;
1492 if ((strtotime($user['login_date']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1494 $statistics['active_users_halfyear']++;
1497 if ((strtotime($user['login_date']) > $month) || (strtotime($user['last-item']) > $month)
1499 $statistics['active_users_monthly']++;
1502 if ((strtotime($user['login_date']) > $week) || (strtotime($user['last-item']) > $week)
1504 $statistics['active_users_weekly']++;
1507 DBA::close($userStmt);
1513 * Get all users of the current node
1515 * @param int $start Start count (Default is 0)
1516 * @param int $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1517 * @param string $type The type of users, which should get (all, bocked, removed)
1518 * @param string $order Order of the user list (Default is 'contact.name')
1519 * @param bool $descending Order direction (Default is ascending)
1521 * @return array The list of the users
1524 public static function getList($start = 0, $count = Pager::ITEMS_PER_PAGE, $type = 'all', $order = 'name', bool $descending = false)
1526 $param = ['limit' => [$start, $count], 'order' => [$order => $descending]];
1530 $condition['account_removed'] = false;
1531 $condition['blocked'] = false;
1534 $condition['account_removed'] = false;
1535 $condition['blocked'] = true;
1536 $condition['verified'] = true;
1539 $condition['account_removed'] = true;
1543 return DBA::selectToArray('owner-view', [], $condition, $param);