src/Model/User.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2020, Friendica
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Model;
  23
  24 use DivineOmega\PasswordExposed;
  25 use Exception;
  26 use Friendica\Content\Pager;
  27 use Friendica\Core\Hook;
  28 use Friendica\Core\L10n;
  29 use Friendica\Core\Logger;
  30 use Friendica\Core\Protocol;
  31 use Friendica\Core\System;
  32 use Friendica\Core\Worker;
  33 use Friendica\Database\DBA;
  34 use Friendica\DI;
  35 use Friendica\Model\TwoFactor\AppSpecificPassword;
  36 use Friendica\Network\HTTPException\InternalServerErrorException;
  37 use Friendica\Object\Image;
  38 use Friendica\Util\Crypto;
  39 use Friendica\Util\DateTimeFormat;
  40 use Friendica\Util\Images;
  41 use Friendica\Util\Network;
  42 use Friendica\Util\Strings;
  43 use Friendica\Worker\Delivery;
  44 use LightOpenID;
  45
  46 /**
  47  * This class handles User related functions
  48  */
  49 class User
  50 {
  51         /**
  52          * Page/profile types
  53          *
  54          * PAGE_FLAGS_NORMAL is a typical personal profile account
  55          * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
  56          * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
  57          *      write access to wall and comments (no email and not included in page owner's ACL lists)
  58          * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
  59          *
  60          * @{
  61          */
  62         const PAGE_FLAGS_NORMAL    = 0;
  63         const PAGE_FLAGS_SOAPBOX   = 1;
  64         const PAGE_FLAGS_COMMUNITY = 2;
  65         const PAGE_FLAGS_FREELOVE  = 3;
  66         const PAGE_FLAGS_BLOG      = 4;
  67         const PAGE_FLAGS_PRVGROUP  = 5;
  68         /**
  69          * @}
  70          */
  71
  72         /**
  73          * Account types
  74          *
  75          * ACCOUNT_TYPE_PERSON - the account belongs to a person
  76          *      Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
  77          *
  78          * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
  79          *      Associated page type: PAGE_FLAGS_SOAPBOX
  80          *
  81          * ACCOUNT_TYPE_NEWS - the account is a news reflector
  82          *      Associated page type: PAGE_FLAGS_SOAPBOX
  83          *
  84          * ACCOUNT_TYPE_COMMUNITY - the account is community forum
  85          *      Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
  86          *
  87          * ACCOUNT_TYPE_RELAY - the account is a relay
  88          *      This will only be assigned to contacts, not to user accounts
  89          * @{
  90          */
  91         const ACCOUNT_TYPE_PERSON =       0;
  92         const ACCOUNT_TYPE_ORGANISATION = 1;
  93         const ACCOUNT_TYPE_NEWS =         2;
  94         const ACCOUNT_TYPE_COMMUNITY =    3;
  95         const ACCOUNT_TYPE_RELAY =        4;
  96         /**
  97          * @}
  98          */
  99
 100         /**
 101          * Returns true if a user record exists with the provided id
 102          *
 103          * @param  integer $uid
 104          * @return boolean
 105          * @throws Exception
 106          */
 107         public static function exists($uid)
 108         {
 109                 return DBA::exists('user', ['uid' => $uid]);
 110         }
 111
 112         /**
 113          * @param  integer       $uid
 114          * @param array          $fields
 115          * @return array|boolean User record if it exists, false otherwise
 116          * @throws Exception
 117          */
 118         public static function getById($uid, array $fields = [])
 119         {
 120                 return DBA::selectFirst('user', $fields, ['uid' => $uid]);
 121         }
 122
 123         /**
 124          * Returns a user record based on it's GUID
 125          *
 126          * @param string $guid   The guid of the user
 127          * @param array  $fields The fields to retrieve
 128          * @param bool   $active True, if only active records are searched
 129          *
 130          * @return array|boolean User record if it exists, false otherwise
 131          * @throws Exception
 132          */
 133         public static function getByGuid(string $guid, array $fields = [], bool $active = true)
 134         {
 135                 if ($active) {
 136                         $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
 137                 } else {
 138                         $cond = ['guid' => $guid];
 139                 }
 140
 141                 return DBA::selectFirst('user', $fields, $cond);
 142         }
 143
 144         /**
 145          * @param  string        $nickname
 146          * @param array          $fields
 147          * @return array|boolean User record if it exists, false otherwise
 148          * @throws Exception
 149          */
 150         public static function getByNickname($nickname, array $fields = [])
 151         {
 152                 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
 153         }
 154
 155         /**
 156          * Returns the user id of a given profile URL
 157          *
 158          * @param string $url
 159          *
 160          * @return integer user id
 161          * @throws Exception
 162          */
 163         public static function getIdForURL($url)
 164         {
 165                 $self = DBA::selectFirst('contact', ['uid'], ['nurl' => Strings::normaliseLink($url), 'self' => true]);
 166                 if (!DBA::isResult($self)) {
 167                         return false;
 168                 } else {
 169                         return $self['uid'];
 170                 }
 171         }
 172
 173         /**
 174          * Get a user based on its email
 175          *
 176          * @param string        $email
 177          * @param array          $fields
 178          *
 179          * @return array|boolean User record if it exists, false otherwise
 180          *
 181          * @throws Exception
 182          */
 183         public static function getByEmail($email, array $fields = [])
 184         {
 185                 return DBA::selectFirst('user', $fields, ['email' => $email]);
 186         }
 187
 188         /**
 189          * Get owner data by user id
 190          *
 191          * @param int $uid
 192          * @param boolean $check_valid Test if data is invalid and correct it
 193          * @return boolean|array
 194          * @throws Exception
 195          */
 196         public static function getOwnerDataById($uid, $check_valid = true)
 197         {
 198                 $r = DBA::fetchFirst(
 199                         "SELECT
 200                         `contact`.*,
 201                         `user`.`prvkey` AS `uprvkey`,
 202                         `user`.`timezone`,
 203                         `user`.`nickname`,
 204                         `user`.`sprvkey`,
 205                         `user`.`spubkey`,
 206                         `user`.`page-flags`,
 207                         `user`.`account-type`,
 208                         `user`.`prvnets`,
 209                         `user`.`account_removed`,
 210                         `user`.`hidewall`
 211                         FROM `contact`
 212                         INNER JOIN `user`
 213                                 ON `user`.`uid` = `contact`.`uid`
 214                         WHERE `contact`.`uid` = ?
 215                         AND `contact`.`self`
 216                         LIMIT 1",
 217                         $uid
 218                 );
 219                 if (!DBA::isResult($r)) {
 220                         return false;
 221                 }
 222
 223                 if (empty($r['nickname'])) {
 224                         return false;
 225                 }
 226
 227                 if (!$check_valid) {
 228                         return $r;
 229                 }
 230
 231                 // Check if the returned data is valid, otherwise fix it. See issue #6122
 232
 233                 // Check for correct url and normalised nurl
 234                 $url = DI::baseUrl() . '/profile/' . $r['nickname'];
 235                 $repair = ($r['url'] != $url) || ($r['nurl'] != Strings::normaliseLink($r['url']));
 236
 237                 if (!$repair) {
 238                         // Check if "addr" is present and correct
 239                         $addr = $r['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
 240                         $repair = ($addr != $r['addr']);
 241                 }
 242
 243                 if (!$repair) {
 244                         // Check if the avatar field is filled and the photo directs to the correct path
 245                         $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
 246                         if (DBA::isResult($avatar)) {
 247                                 $repair = empty($r['avatar']) || !strpos($r['photo'], $avatar['resource-id']);
 248                         }
 249                 }
 250
 251                 if ($repair) {
 252                         Contact::updateSelfFromUserID($uid);
 253                         // Return the corrected data and avoid a loop
 254                         $r = self::getOwnerDataById($uid, false);
 255                 }
 256
 257                 return $r;
 258         }
 259
 260         /**
 261          * Get owner data by nick name
 262          *
 263          * @param int $nick
 264          * @return boolean|array
 265          * @throws Exception
 266          */
 267         public static function getOwnerDataByNick($nick)
 268         {
 269                 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
 270
 271                 if (!DBA::isResult($user)) {
 272                         return false;
 273                 }
 274
 275                 return self::getOwnerDataById($user['uid']);
 276         }
 277
 278         /**
 279          * Returns the default group for a given user and network
 280          *
 281          * @param int $uid User id
 282          * @param string $network network name
 283          *
 284          * @return int group id
 285          * @throws InternalServerErrorException
 286          */
 287         public static function getDefaultGroup($uid, $network = '')
 288         {
 289                 $default_group = 0;
 290
 291                 if ($network == Protocol::OSTATUS) {
 292                         $default_group = DI::pConfig()->get($uid, "ostatus", "default_group");
 293                 }
 294
 295                 if ($default_group != 0) {
 296                         return $default_group;
 297                 }
 298
 299                 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
 300
 301                 if (DBA::isResult($user)) {
 302                         $default_group = $user["def_gid"];
 303                 }
 304
 305                 return $default_group;
 306         }
 307
 308
 309         /**
 310          * Authenticate a user with a clear text password
 311          *
 312          * @param mixed  $user_info
 313          * @param string $password
 314          * @param bool   $third_party
 315          * @return int|boolean
 316          * @deprecated since version 3.6
 317          * @see        User::getIdFromPasswordAuthentication()
 318          */
 319         public static function authenticate($user_info, $password, $third_party = false)
 320         {
 321                 try {
 322                         return self::getIdFromPasswordAuthentication($user_info, $password, $third_party);
 323                 } catch (Exception $ex) {
 324                         return false;
 325                 }
 326         }
 327
 328         /**
 329          * Authenticate a user with a clear text password
 330          *
 331          * Returns the user id associated with a successful password authentication
 332          *
 333          * @param mixed  $user_info
 334          * @param string $password
 335          * @param bool   $third_party
 336          * @return int User Id if authentication is successful
 337          * @throws Exception
 338          */
 339         public static function getIdFromPasswordAuthentication($user_info, $password, $third_party = false)
 340         {
 341                 $user = self::getAuthenticationInfo($user_info);
 342
 343                 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
 344                         // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
 345                         if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
 346                                 return $user['uid'];
 347                         }
 348                 } elseif (strpos($user['password'], '$') === false) {
 349                         //Legacy hash that has not been replaced by a new hash yet
 350                         if (self::hashPasswordLegacy($password) === $user['password']) {
 351                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 352
 353                                 return $user['uid'];
 354                         }
 355                 } elseif (!empty($user['legacy_password'])) {
 356                         //Legacy hash that has been double-hashed and not replaced by a new hash yet
 357                         //Warning: `legacy_password` is not necessary in sync with the content of `password`
 358                         if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
 359                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 360
 361                                 return $user['uid'];
 362                         }
 363                 } elseif (password_verify($password, $user['password'])) {
 364                         //New password hash
 365                         if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
 366                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 367                         }
 368
 369                         return $user['uid'];
 370                 }
 371
 372                 throw new Exception(DI::l10n()->t('Login failed'));
 373         }
 374
 375         /**
 376          * Returns authentication info from various parameters types
 377          *
 378          * User info can be any of the following:
 379          * - User DB object
 380          * - User Id
 381          * - User email or username or nickname
 382          * - User array with at least the uid and the hashed password
 383          *
 384          * @param mixed $user_info
 385          * @return array
 386          * @throws Exception
 387          */
 388         private static function getAuthenticationInfo($user_info)
 389         {
 390                 $user = null;
 391
 392                 if (is_object($user_info) || is_array($user_info)) {
 393                         if (is_object($user_info)) {
 394                                 $user = (array) $user_info;
 395                         } else {
 396                                 $user = $user_info;
 397                         }
 398
 399                         if (
 400                                 !isset($user['uid'])
 401                                 || !isset($user['password'])
 402                                 || !isset($user['legacy_password'])
 403                         ) {
 404                                 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
 405                         }
 406                 } elseif (is_int($user_info) || is_string($user_info)) {
 407                         if (is_int($user_info)) {
 408                                 $user = DBA::selectFirst(
 409                                         'user',
 410                                         ['uid', 'password', 'legacy_password'],
 411                                         [
 412                                                 'uid' => $user_info,
 413                                                 'blocked' => 0,
 414                                                 'account_expired' => 0,
 415                                                 'account_removed' => 0,
 416                                                 'verified' => 1
 417                                         ]
 418                                 );
 419                         } else {
 420                                 $fields = ['uid', 'password', 'legacy_password'];
 421                                 $condition = [
 422                                         "(`email` = ? OR `username` = ? OR `nickname` = ?)
 423                                         AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
 424                                         $user_info, $user_info, $user_info
 425                                 ];
 426                                 $user = DBA::selectFirst('user', $fields, $condition);
 427                         }
 428
 429                         if (!DBA::isResult($user)) {
 430                                 throw new Exception(DI::l10n()->t('User not found'));
 431                         }
 432                 }
 433
 434                 return $user;
 435         }
 436
 437         /**
 438          * Generates a human-readable random password
 439          *
 440          * @return string
 441          */
 442         public static function generateNewPassword()
 443         {
 444                 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
 445         }
 446
 447         /**
 448          * Checks if the provided plaintext password has been exposed or not
 449          *
 450          * @param string $password
 451          * @return bool
 452          * @throws Exception
 453          */
 454         public static function isPasswordExposed($password)
 455         {
 456                 $cache = new \DivineOmega\DOFileCachePSR6\CacheItemPool();
 457                 $cache->changeConfig([
 458                         'cacheDirectory' => get_temppath() . '/password-exposed-cache/',
 459                 ]);
 460
 461                 try {
 462                         $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
 463
 464                         return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
 465                 } catch (\Exception $e) {
 466                         Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
 467                                 'code' => $e->getCode(),
 468                                 'file' => $e->getFile(),
 469                                 'line' => $e->getLine(),
 470                                 'trace' => $e->getTraceAsString()
 471                         ]);
 472
 473                         return false;
 474                 }
 475         }
 476
 477         /**
 478          * Legacy hashing function, kept for password migration purposes
 479          *
 480          * @param string $password
 481          * @return string
 482          */
 483         private static function hashPasswordLegacy($password)
 484         {
 485                 return hash('whirlpool', $password);
 486         }
 487
 488         /**
 489          * Global user password hashing function
 490          *
 491          * @param string $password
 492          * @return string
 493          * @throws Exception
 494          */
 495         public static function hashPassword($password)
 496         {
 497                 if (!trim($password)) {
 498                         throw new Exception(DI::l10n()->t('Password can\'t be empty'));
 499                 }
 500
 501                 return password_hash($password, PASSWORD_DEFAULT);
 502         }
 503
 504         /**
 505          * Updates a user row with a new plaintext password
 506          *
 507          * @param int    $uid
 508          * @param string $password
 509          * @return bool
 510          * @throws Exception
 511          */
 512         public static function updatePassword($uid, $password)
 513         {
 514                 $password = trim($password);
 515
 516                 if (empty($password)) {
 517                         throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
 518                 }
 519
 520                 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
 521                         throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
 522                 }
 523
 524                 $allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
 525
 526                 if (!preg_match('/^[a-z0-9' . preg_quote($allowed_characters, '/') . ']+$/i', $password)) {
 527                         throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
 528                 }
 529
 530                 return self::updatePasswordHashed($uid, self::hashPassword($password));
 531         }
 532
 533         /**
 534          * Updates a user row with a new hashed password.
 535          * Empties the password reset token field just in case.
 536          *
 537          * @param int    $uid
 538          * @param string $pasword_hashed
 539          * @return bool
 540          * @throws Exception
 541          */
 542         private static function updatePasswordHashed($uid, $pasword_hashed)
 543         {
 544                 $fields = [
 545                         'password' => $pasword_hashed,
 546                         'pwdreset' => null,
 547                         'pwdreset_time' => null,
 548                         'legacy_password' => false
 549                 ];
 550                 return DBA::update('user', $fields, ['uid' => $uid]);
 551         }
 552
 553         /**
 554          * Checks if a nickname is in the list of the forbidden nicknames
 555          *
 556          * Check if a nickname is forbidden from registration on the node by the
 557          * admin. Forbidden nicknames (e.g. role namess) can be configured in the
 558          * admin panel.
 559          *
 560          * @param string $nickname The nickname that should be checked
 561          * @return boolean True is the nickname is blocked on the node
 562          * @throws InternalServerErrorException
 563          */
 564         public static function isNicknameBlocked($nickname)
 565         {
 566                 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
 567
 568                 // if the config variable is empty return false
 569                 if (empty($forbidden_nicknames)) {
 570                         return false;
 571                 }
 572
 573                 // check if the nickname is in the list of blocked nicknames
 574                 $forbidden = explode(',', $forbidden_nicknames);
 575                 $forbidden = array_map('trim', $forbidden);
 576                 if (in_array(strtolower($nickname), $forbidden)) {
 577                         return true;
 578                 }
 579
 580                 // else return false
 581                 return false;
 582         }
 583
 584         /**
 585          * Catch-all user creation function
 586          *
 587          * Creates a user from the provided data array, either form fields or OpenID.
 588          * Required: { username, nickname, email } or { openid_url }
 589          *
 590          * Performs the following:
 591          * - Sends to the OpenId auth URL (if relevant)
 592          * - Creates new key pairs for crypto
 593          * - Create self-contact
 594          * - Create profile image
 595          *
 596          * @param  array $data
 597          * @return array
 598          * @throws \ErrorException
 599          * @throws InternalServerErrorException
 600          * @throws \ImagickException
 601          * @throws Exception
 602          */
 603         public static function create(array $data)
 604         {
 605                 $return = ['user' => null, 'password' => ''];
 606
 607                 $using_invites = DI::config()->get('system', 'invitation_only');
 608
 609                 $invite_id  = !empty($data['invite_id'])  ? Strings::escapeTags(trim($data['invite_id']))  : '';
 610                 $username   = !empty($data['username'])   ? Strings::escapeTags(trim($data['username']))   : '';
 611                 $nickname   = !empty($data['nickname'])   ? Strings::escapeTags(trim($data['nickname']))   : '';
 612                 $email      = !empty($data['email'])      ? Strings::escapeTags(trim($data['email']))      : '';
 613                 $openid_url = !empty($data['openid_url']) ? Strings::escapeTags(trim($data['openid_url'])) : '';
 614                 $photo      = !empty($data['photo'])      ? Strings::escapeTags(trim($data['photo']))      : '';
 615                 $password   = !empty($data['password'])   ? trim($data['password'])           : '';
 616                 $password1  = !empty($data['password1'])  ? trim($data['password1'])          : '';
 617                 $confirm    = !empty($data['confirm'])    ? trim($data['confirm'])            : '';
 618                 $blocked    = !empty($data['blocked']);
 619                 $verified   = !empty($data['verified']);
 620                 $language   = !empty($data['language'])   ? Strings::escapeTags(trim($data['language']))   : 'en';
 621
 622                 $netpublish = $publish = !empty($data['profile_publish_reg']);
 623
 624                 if ($password1 != $confirm) {
 625                         throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
 626                 } elseif ($password1 != '') {
 627                         $password = $password1;
 628                 }
 629
 630                 if ($using_invites) {
 631                         if (!$invite_id) {
 632                                 throw new Exception(DI::l10n()->t('An invitation is required.'));
 633                         }
 634
 635                         if (!Register::existsByHash($invite_id)) {
 636                                 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
 637                         }
 638                 }
 639
 640                 /// @todo Check if this part is really needed. We should have fetched all this data in advance
 641                 if (empty($username) || empty($email) || empty($nickname)) {
 642                         if ($openid_url) {
 643                                 if (!Network::isUrlValid($openid_url)) {
 644                                         throw new Exception(DI::l10n()->t('Invalid OpenID url'));
 645                                 }
 646                                 $_SESSION['register'] = 1;
 647                                 $_SESSION['openid'] = $openid_url;
 648
 649                                 $openid = new LightOpenID(DI::baseUrl()->getHostname());
 650                                 $openid->identity = $openid_url;
 651                                 $openid->returnUrl = DI::baseUrl() . '/openid';
 652                                 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
 653                                 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
 654                                 try {
 655                                         $authurl = $openid->authUrl();
 656                                 } catch (Exception $e) {
 657                                         throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . EOL . EOL . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
 658                                 }
 659                                 System::externalRedirect($authurl);
 660                                 // NOTREACHED
 661                         }
 662
 663                         throw new Exception(DI::l10n()->t('Please enter the required information.'));
 664                 }
 665
 666                 if (!Network::isUrlValid($openid_url)) {
 667                         $openid_url = '';
 668                 }
 669
 670                 // collapse multiple spaces in name
 671                 $username = preg_replace('/ +/', ' ', $username);
 672
 673                 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
 674                 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
 675
 676                 if ($username_min_length > $username_max_length) {
 677                         Logger::log(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length), Logger::WARNING);
 678                         $tmp = $username_min_length;
 679                         $username_min_length = $username_max_length;
 680                         $username_max_length = $tmp;
 681                 }
 682
 683                 if (mb_strlen($username) < $username_min_length) {
 684                         throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
 685                 }
 686
 687                 if (mb_strlen($username) > $username_max_length) {
 688                         throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
 689                 }
 690
 691                 // So now we are just looking for a space in the full name.
 692                 $loose_reg = DI::config()->get('system', 'no_regfullname');
 693                 if (!$loose_reg) {
 694                         $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
 695                         if (strpos($username, ' ') === false) {
 696                                 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
 697                         }
 698                 }
 699
 700                 if (!Network::isEmailDomainAllowed($email)) {
 701                         throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
 702                 }
 703
 704                 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
 705                         throw new Exception(DI::l10n()->t('Not a valid email address.'));
 706                 }
 707                 if (self::isNicknameBlocked($nickname)) {
 708                         throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
 709                 }
 710
 711                 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
 712                         throw new Exception(DI::l10n()->t('Cannot use that email.'));
 713                 }
 714
 715                 // Disallow somebody creating an account using openid that uses the admin email address,
 716                 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
 717                 if (DI::config()->get('config', 'admin_email') && strlen($openid_url)) {
 718                         $adminlist = explode(',', str_replace(' ', '', strtolower(DI::config()->get('config', 'admin_email'))));
 719                         if (in_array(strtolower($email), $adminlist)) {
 720                                 throw new Exception(DI::l10n()->t('Cannot use that email.'));
 721                         }
 722                 }
 723
 724                 $nickname = $data['nickname'] = strtolower($nickname);
 725
 726                 if (!preg_match('/^[a-z0-9][a-z0-9\_]*$/', $nickname)) {
 727                         throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
 728                 }
 729
 730                 // Check existing and deleted accounts for this nickname.
 731                 if (
 732                         DBA::exists('user', ['nickname' => $nickname])
 733                         || DBA::exists('userd', ['username' => $nickname])
 734                 ) {
 735                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
 736                 }
 737
 738                 $new_password = strlen($password) ? $password : User::generateNewPassword();
 739                 $new_password_encoded = self::hashPassword($new_password);
 740
 741                 $return['password'] = $new_password;
 742
 743                 $keys = Crypto::newKeypair(4096);
 744                 if ($keys === false) {
 745                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 746                 }
 747
 748                 $prvkey = $keys['prvkey'];
 749                 $pubkey = $keys['pubkey'];
 750
 751                 // Create another keypair for signing/verifying salmon protocol messages.
 752                 $sres = Crypto::newKeypair(512);
 753                 $sprvkey = $sres['prvkey'];
 754                 $spubkey = $sres['pubkey'];
 755
 756                 $insert_result = DBA::insert('user', [
 757                         'guid'     => System::createUUID(),
 758                         'username' => $username,
 759                         'password' => $new_password_encoded,
 760                         'email'    => $email,
 761                         'openid'   => $openid_url,
 762                         'nickname' => $nickname,
 763                         'pubkey'   => $pubkey,
 764                         'prvkey'   => $prvkey,
 765                         'spubkey'  => $spubkey,
 766                         'sprvkey'  => $sprvkey,
 767                         'verified' => $verified,
 768                         'blocked'  => $blocked,
 769                         'language' => $language,
 770                         'timezone' => 'UTC',
 771                         'register_date' => DateTimeFormat::utcNow(),
 772                         'default-location' => ''
 773                 ]);
 774
 775                 if ($insert_result) {
 776                         $uid = DBA::lastInsertId();
 777                         $user = DBA::selectFirst('user', [], ['uid' => $uid]);
 778                 } else {
 779                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
 780                 }
 781
 782                 if (!$uid) {
 783                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
 784                 }
 785
 786                 // if somebody clicked submit twice very quickly, they could end up with two accounts
 787                 // due to race condition. Remove this one.
 788                 $user_count = DBA::count('user', ['nickname' => $nickname]);
 789                 if ($user_count > 1) {
 790                         DBA::delete('user', ['uid' => $uid]);
 791
 792                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
 793                 }
 794
 795                 $insert_result = DBA::insert('profile', [
 796                         'uid' => $uid,
 797                         'name' => $username,
 798                         'photo' => DI::baseUrl() . "/photo/profile/{$uid}.jpg",
 799                         'thumb' => DI::baseUrl() . "/photo/avatar/{$uid}.jpg",
 800                         'publish' => $publish,
 801                         'net-publish' => $netpublish,
 802                 ]);
 803                 if (!$insert_result) {
 804                         DBA::delete('user', ['uid' => $uid]);
 805
 806                         throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
 807                 }
 808
 809                 // Create the self contact
 810                 if (!Contact::createSelfFromUserId($uid)) {
 811                         DBA::delete('user', ['uid' => $uid]);
 812
 813                         throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
 814                 }
 815
 816                 // Create a group with no members. This allows somebody to use it
 817                 // right away as a default group for new contacts.
 818                 $def_gid = Group::create($uid, DI::l10n()->t('Friends'));
 819                 if (!$def_gid) {
 820                         DBA::delete('user', ['uid' => $uid]);
 821
 822                         throw new Exception(DI::l10n()->t('An error occurred creating your default contact group. Please try again.'));
 823                 }
 824
 825                 $fields = ['def_gid' => $def_gid];
 826                 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
 827                         $fields['allow_gid'] = '<' . $def_gid . '>';
 828                 }
 829
 830                 DBA::update('user', $fields, ['uid' => $uid]);
 831
 832                 // if we have no OpenID photo try to look up an avatar
 833                 if (!strlen($photo)) {
 834                         $photo = Network::lookupAvatarByEmail($email);
 835                 }
 836
 837                 // unless there is no avatar-addon loaded
 838                 if (strlen($photo)) {
 839                         $photo_failure = false;
 840
 841                         $filename = basename($photo);
 842                         $img_str = Network::fetchUrl($photo, true);
 843                         // guess mimetype from headers or filename
 844                         $type = Images::guessType($photo, true);
 845
 846                         $Image = new Image($img_str, $type);
 847                         if ($Image->isValid()) {
 848                                 $Image->scaleToSquare(300);
 849
 850                                 $resource_id = Photo::newResource();
 851
 852                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 4);
 853
 854                                 if ($r === false) {
 855                                         $photo_failure = true;
 856                                 }
 857
 858                                 $Image->scaleDown(80);
 859
 860                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 5);
 861
 862                                 if ($r === false) {
 863                                         $photo_failure = true;
 864                                 }
 865
 866                                 $Image->scaleDown(48);
 867
 868                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 6);
 869
 870                                 if ($r === false) {
 871                                         $photo_failure = true;
 872                                 }
 873
 874                                 if (!$photo_failure) {
 875                                         Photo::update(['profile' => 1], ['resource-id' => $resource_id]);
 876                                 }
 877                         }
 878                 }
 879
 880                 Hook::callAll('register_account', $uid);
 881
 882                 $return['user'] = $user;
 883                 return $return;
 884         }
 885
 886         /**
 887          * Sets block state for a given user
 888          *
 889          * @param int  $uid   The user id
 890          * @param bool $block Block state (default is true)
 891          *
 892          * @return bool True, if successfully blocked
 893
 894          * @throws Exception
 895          */
 896         public static function block(int $uid, bool $block = true)
 897         {
 898                 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
 899         }
 900
 901         /**
 902          * Allows a registration based on a hash
 903          *
 904          * @param string $hash
 905          *
 906          * @return bool True, if the allow was successful
 907          *
 908          * @throws InternalServerErrorException
 909          * @throws Exception
 910          */
 911         public static function allow(string $hash)
 912         {
 913                 $register = Register::getByHash($hash);
 914                 if (!DBA::isResult($register)) {
 915                         return false;
 916                 }
 917
 918                 $user = User::getById($register['uid']);
 919                 if (!DBA::isResult($user)) {
 920                         return false;
 921                 }
 922
 923                 Register::deleteByHash($hash);
 924
 925                 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
 926
 927                 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
 928
 929                 if (DBA::isResult($profile) && $profile['net-publish'] && DI::config()->get('system', 'directory')) {
 930                         $url = DI::baseUrl() . '/profile/' . $user['nickname'];
 931                         Worker::add(PRIORITY_LOW, "Directory", $url);
 932                 }
 933
 934                 $l10n = DI::l10n()->withLang($register['language']);
 935
 936                 return User::sendRegisterOpenEmail(
 937                         $l10n,
 938                         $user,
 939                         DI::config()->get('config', 'sitename'),
 940                         DI::baseUrl()->get(),
 941                         ($register['password'] ?? '') ?: 'Sent in a previous email'
 942                 );
 943         }
 944
 945         /**
 946          * Denys a pending registration
 947          *
 948          * @param string $hash The hash of the pending user
 949          *
 950          * This does not have to go through user_remove() and save the nickname
 951          * permanently against re-registration, as the person was not yet
 952          * allowed to have friends on this system
 953          *
 954          * @return bool True, if the deny was successfull
 955          * @throws Exception
 956          */
 957         public static function deny(string $hash)
 958         {
 959                 $register = Register::getByHash($hash);
 960                 if (!DBA::isResult($register)) {
 961                         return false;
 962                 }
 963
 964                 $user = User::getById($register['uid']);
 965                 if (!DBA::isResult($user)) {
 966                         return false;
 967                 }
 968
 969                 return DBA::delete('user', ['uid' => $register['uid']]) &&
 970                        Register::deleteByHash($register['hash']);
 971         }
 972
 973         /**
 974          * Creates a new user based on a minimal set and sends an email to this user
 975          *
 976          * @param string $name  The user's name
 977          * @param string $email The user's email address
 978          * @param string $nick  The user's nick name
 979          * @param string $lang  The user's language (default is english)
 980          *
 981          * @return bool True, if the user was created successfully
 982          * @throws InternalServerErrorException
 983          * @throws \ErrorException
 984          * @throws \ImagickException
 985          */
 986         public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT)
 987         {
 988                 if (empty($name) ||
 989                     empty($email) ||
 990                     empty($nick)) {
 991                         throw new InternalServerErrorException('Invalid arguments.');
 992                 }
 993
 994                 $result = self::create([
 995                         'username' => $name,
 996                         'email' => $email,
 997                         'nickname' => $nick,
 998                         'verified' => 1,
 999                         'language' => $lang
1000                 ]);
1001
1002                 $user = $result['user'];
1003                 $preamble = Strings::deindent(DI::l10n()->t('
1004                 Dear %1$s,
1005                         the administrator of %2$s has set up an account for you.'));
1006                 $body = Strings::deindent(DI::l10n()->t('
1007                 The login details are as follows:
1008
1009                 Site Location:  %1$s
1010                 Login Name:             %2$s
1011                 Password:               %3$s
1012
1013                 You may change your password from your account "Settings" page after logging
1014                 in.
1015
1016                 Please take a few moments to review the other account settings on that page.
1017
1018                 You may also wish to add some basic information to your default profile
1019                 (on the "Profiles" page) so that other people can easily find you.
1020
1021                 We recommend setting your full name, adding a profile photo,
1022                 adding some profile "keywords" (very useful in making new friends) - and
1023                 perhaps what country you live in; if you do not wish to be more specific
1024                 than that.
1025
1026                 We fully respect your right to privacy, and none of these items are necessary.
1027                 If you are new and do not know anybody here, they may help
1028                 you to make some new and interesting friends.
1029
1030                 If you ever want to delete your account, you can do so at %1$s/removeme
1031
1032                 Thank you and welcome to %4$s.'));
1033
1034                 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1035                 $body = sprintf($body, DI::baseUrl()->get(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1036
1037                 $email = DI::emailer()
1038                         ->newSystemMail()
1039                         ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1040                         ->forUser($user)
1041                         ->withRecipient($user['email'])
1042                         ->build();
1043                 return DI::emailer()->send($email);
1044         }
1045
1046         /**
1047          * Sends pending registration confirmation email
1048          *
1049          * @param array  $user     User record array
1050          * @param string $sitename
1051          * @param string $siteurl
1052          * @param string $password Plaintext password
1053          * @return NULL|boolean from notification() and email() inherited
1054          * @throws InternalServerErrorException
1055          */
1056         public static function sendRegisterPendingEmail($user, $sitename, $siteurl, $password)
1057         {
1058                 $body = Strings::deindent(DI::l10n()->t(
1059                         '
1060                         Dear %1$s,
1061                                 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1062
1063                         Your login details are as follows:
1064
1065                         Site Location:  %3$s
1066                         Login Name:             %4$s
1067                         Password:               %5$s
1068                 ',
1069                         $user['username'],
1070                         $sitename,
1071                         $siteurl,
1072                         $user['nickname'],
1073                         $password
1074                 ));
1075
1076                 $email = DI::emailer()
1077                         ->newSystemMail()
1078                         ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1079                         ->forUser($user)
1080                         ->withRecipient($user['email'])
1081                         ->build();
1082                 return DI::emailer()->send($email);
1083         }
1084
1085         /**
1086          * Sends registration confirmation
1087          *
1088          * It's here as a function because the mail is sent from different parts
1089          *
1090          * @param \Friendica\Core\L10n $l10n     The used language
1091          * @param array                $user     User record array
1092          * @param string               $sitename
1093          * @param string               $siteurl
1094          * @param string               $password Plaintext password
1095          *
1096          * @return NULL|boolean from notification() and email() inherited
1097          * @throws InternalServerErrorException
1098          */
1099         public static function sendRegisterOpenEmail(\Friendica\Core\L10n $l10n, $user, $sitename, $siteurl, $password)
1100         {
1101                 $preamble = Strings::deindent($l10n->t(
1102                         '
1103                                 Dear %1$s,
1104                                 Thank you for registering at %2$s. Your account has been created.
1105                         ',
1106                         $user['username'],
1107                         $sitename
1108                 ));
1109                 $body = Strings::deindent($l10n->t(
1110                         '
1111                         The login details are as follows:
1112
1113                         Site Location:  %3$s
1114                         Login Name:             %1$s
1115                         Password:               %5$s
1116
1117                         You may change your password from your account "Settings" page after logging
1118                         in.
1119
1120                         Please take a few moments to review the other account settings on that page.
1121
1122                         You may also wish to add some basic information to your default profile
1123                         ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1124
1125                         We recommend setting your full name, adding a profile photo,
1126                         adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1127                         perhaps what country you live in; if you do not wish to be more specific
1128                         than that.
1129
1130                         We fully respect your right to privacy, and none of these items are necessary.
1131                         If you are new and do not know anybody here, they may help
1132                         you to make some new and interesting friends.
1133
1134                         If you ever want to delete your account, you can do so at %3$s/removeme
1135
1136                         Thank you and welcome to %2$s.',
1137                         $user['nickname'],
1138                         $sitename,
1139                         $siteurl,
1140                         $user['username'],
1141                         $password
1142                 ));
1143
1144                 $email = DI::emailer()
1145                         ->newSystemMail()
1146                         ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1147                         ->forUser($user)
1148                         ->withRecipient($user['email'])
1149                         ->build();
1150                 return DI::emailer()->send($email);
1151         }
1152
1153         /**
1154          * @param int $uid user to remove
1155          * @return bool
1156          * @throws InternalServerErrorException
1157          */
1158         public static function remove(int $uid)
1159         {
1160                 if (!$uid) {
1161                         return false;
1162                 }
1163
1164                 Logger::log('Removing user: ' . $uid);
1165
1166                 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1167
1168                 Hook::callAll('remove_user', $user);
1169
1170                 // save username (actually the nickname as it is guaranteed
1171                 // unique), so it cannot be re-registered in the future.
1172                 DBA::insert('userd', ['username' => $user['nickname']]);
1173
1174                 // The user and related data will be deleted in "cron_expire_and_remove_users" (cronjobs.php)
1175                 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1176                 Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1177
1178                 // Send an update to the directory
1179                 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1180                 Worker::add(PRIORITY_LOW, 'Directory', $self['url']);
1181
1182                 // Remove the user relevant data
1183                 Worker::add(PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1184
1185                 return true;
1186         }
1187
1188         /**
1189          * Return all identities to a user
1190          *
1191          * @param int $uid The user id
1192          * @return array All identities for this user
1193          *
1194          * Example for a return:
1195          *    [
1196          *        [
1197          *            'uid' => 1,
1198          *            'username' => 'maxmuster',
1199          *            'nickname' => 'Max Mustermann'
1200          *        ],
1201          *        [
1202          *            'uid' => 2,
1203          *            'username' => 'johndoe',
1204          *            'nickname' => 'John Doe'
1205          *        ]
1206          *    ]
1207          * @throws Exception
1208          */
1209         public static function identities($uid)
1210         {
1211                 $identities = [];
1212
1213                 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1214                 if (!DBA::isResult($user)) {
1215                         return $identities;
1216                 }
1217
1218                 if ($user['parent-uid'] == 0) {
1219                         // First add our own entry
1220                         $identities = [[
1221                                 'uid' => $user['uid'],
1222                                 'username' => $user['username'],
1223                                 'nickname' => $user['nickname']
1224                         ]];
1225
1226                         // Then add all the children
1227                         $r = DBA::select(
1228                                 'user',
1229                                 ['uid', 'username', 'nickname'],
1230                                 ['parent-uid' => $user['uid'], 'account_removed' => false]
1231                         );
1232                         if (DBA::isResult($r)) {
1233                                 $identities = array_merge($identities, DBA::toArray($r));
1234                         }
1235                 } else {
1236                         // First entry is our parent
1237                         $r = DBA::select(
1238                                 'user',
1239                                 ['uid', 'username', 'nickname'],
1240                                 ['uid' => $user['parent-uid'], 'account_removed' => false]
1241                         );
1242                         if (DBA::isResult($r)) {
1243                                 $identities = DBA::toArray($r);
1244                         }
1245
1246                         // Then add all siblings
1247                         $r = DBA::select(
1248                                 'user',
1249                                 ['uid', 'username', 'nickname'],
1250                                 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1251                         );
1252                         if (DBA::isResult($r)) {
1253                                 $identities = array_merge($identities, DBA::toArray($r));
1254                         }
1255                 }
1256
1257                 $r = DBA::p(
1258                         "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1259                         FROM `manage`
1260                         INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1261                         WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1262                         $user['uid']
1263                 );
1264                 if (DBA::isResult($r)) {
1265                         $identities = array_merge($identities, DBA::toArray($r));
1266                 }
1267
1268                 return $identities;
1269         }
1270
1271         /**
1272          * Returns statistical information about the current users of this node
1273          *
1274          * @return array
1275          *
1276          * @throws Exception
1277          */
1278         public static function getStatistics()
1279         {
1280                 $statistics = [
1281                         'total_users'           => 0,
1282                         'active_users_halfyear' => 0,
1283                         'active_users_monthly'  => 0,
1284                 ];
1285
1286                 $userStmt = DBA::p("SELECT `user`.`uid`, `user`.`login_date`, `contact`.`last-item`
1287                         FROM `user`
1288                         INNER JOIN `contact` ON `contact`.`uid` = `user`.`uid` AND `contact`.`self`
1289                         WHERE `user`.`verified`
1290                                 AND `user`.`login_date` > ?
1291                                 AND NOT `user`.`blocked`
1292                                 AND NOT `user`.`account_removed`
1293                                 AND NOT `user`.`account_expired`",
1294                                 DBA::NULL_DATETIME
1295                 );
1296
1297                 if (!DBA::isResult($userStmt)) {
1298                         return $statistics;
1299                 }
1300
1301                 $halfyear = time() - (180 * 24 * 60 * 60);
1302                 $month = time() - (30 * 24 * 60 * 60);
1303
1304                 while ($user = DBA::fetch($userStmt)) {
1305                         $statistics['total_users']++;
1306
1307                         if ((strtotime($user['login_date']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1308                         ) {
1309                                 $statistics['active_users_halfyear']++;
1310                         }
1311
1312                         if ((strtotime($user['login_date']) > $month) || (strtotime($user['last-item']) > $month)
1313                         ) {
1314                                 $statistics['active_users_monthly']++;
1315                         }
1316                 }
1317
1318                 return $statistics;
1319         }
1320
1321         /**
1322          * Get all users of the current node
1323          *
1324          * @param int    $start Start count (Default is 0)
1325          * @param int    $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1326          * @param string $type  The type of users, which should get (all, bocked, removed)
1327          * @param string $order Order of the user list (Default is 'contact.name')
1328          * @param string $order_direction Order direction (Default is ASC)
1329          *
1330          * @return array The list of the users
1331          * @throws Exception
1332          */
1333         public static function getList($start = 0, $count = Pager::ITEMS_PER_PAGE, $type = 'all', $order = 'contact.name', $order_direction = '+')
1334         {
1335                 $sql_order           = '`' . str_replace('.', '`.`', $order) . '`';
1336                 $sql_order_direction = ($order_direction === '+') ? 'ASC' : 'DESC';
1337
1338                 switch ($type) {
1339                         case 'active':
1340                                 $sql_extra = 'AND `user`.`blocked` = 0';
1341                                 break;
1342                         case 'blocked':
1343                                 $sql_extra = 'AND `user`.`blocked` = 1';
1344                                 break;
1345                         case 'removed':
1346                                 $sql_extra = 'AND `user`.`account_removed` = 1';
1347                                 break;
1348                         case 'all':
1349                         default:
1350                                 $sql_extra = '';
1351                                 break;
1352                 }
1353
1354                 $usersStmt = DBA::p("SELECT `user`.*, `contact`.`name`, `contact`.`url`, `contact`.`micro`, `user`.`account_expired`, `contact`.`last-item` AS `lastitem_date`, `contact`.`nick`, `contact`.`created`
1355                                 FROM `user`
1356                                 INNER JOIN `contact` ON `contact`.`uid` = `user`.`uid` AND `contact`.`self`
1357                                 WHERE `user`.`verified` $sql_extra
1358                                 ORDER BY $sql_order $sql_order_direction LIMIT ?, ?", $start, $count
1359                 );
1360
1361                 return DBA::toArray($usersStmt);
1362         }
1363 }