src/Model/User.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2021, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Model;
  23
  24 use DivineOmega\DOFileCachePSR6\CacheItemPool;
  25 use DivineOmega\PasswordExposed;
  26 use ErrorException;
  27 use Exception;
  28 use Friendica\Content\Pager;
  29 use Friendica\Core\Hook;
  30 use Friendica\Core\L10n;
  31 use Friendica\Core\Logger;
  32 use Friendica\Core\Protocol;
  33 use Friendica\Core\System;
  34 use Friendica\Core\Worker;
  35 use Friendica\Database\DBA;
  36 use Friendica\DI;
  37 use Friendica\Security\TwoFactor\Model\AppSpecificPassword;
  38 use Friendica\Network\HTTPException;
  39 use Friendica\Object\Image;
  40 use Friendica\Util\Crypto;
  41 use Friendica\Util\DateTimeFormat;
  42 use Friendica\Util\Images;
  43 use Friendica\Util\Network;
  44 use Friendica\Util\Proxy;
  45 use Friendica\Util\Strings;
  46 use Friendica\Worker\Delivery;
  47 use ImagickException;
  48 use LightOpenID;
  49
  50 /**
  51  * This class handles User related functions
  52  */
  53 class User
  54 {
  55         /**
  56          * Page/profile types
  57          *
  58          * PAGE_FLAGS_NORMAL is a typical personal profile account
  59          * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
  60          * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
  61          *      write access to wall and comments (no email and not included in page owner's ACL lists)
  62          * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
  63          *
  64          * @{
  65          */
  66         const PAGE_FLAGS_NORMAL    = 0;
  67         const PAGE_FLAGS_SOAPBOX   = 1;
  68         const PAGE_FLAGS_COMMUNITY = 2;
  69         const PAGE_FLAGS_FREELOVE  = 3;
  70         const PAGE_FLAGS_BLOG      = 4;
  71         const PAGE_FLAGS_PRVGROUP  = 5;
  72         /**
  73          * @}
  74          */
  75
  76         /**
  77          * Account types
  78          *
  79          * ACCOUNT_TYPE_PERSON - the account belongs to a person
  80          *      Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
  81          *
  82          * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
  83          *      Associated page type: PAGE_FLAGS_SOAPBOX
  84          *
  85          * ACCOUNT_TYPE_NEWS - the account is a news reflector
  86          *      Associated page type: PAGE_FLAGS_SOAPBOX
  87          *
  88          * ACCOUNT_TYPE_COMMUNITY - the account is community forum
  89          *      Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
  90          *
  91          * ACCOUNT_TYPE_RELAY - the account is a relay
  92          *      This will only be assigned to contacts, not to user accounts
  93          * @{
  94          */
  95         const ACCOUNT_TYPE_PERSON =       0;
  96         const ACCOUNT_TYPE_ORGANISATION = 1;
  97         const ACCOUNT_TYPE_NEWS =         2;
  98         const ACCOUNT_TYPE_COMMUNITY =    3;
  99         const ACCOUNT_TYPE_RELAY =        4;
 100         const ACCOUNT_TYPE_DELETED =    127;
 101         /**
 102          * @}
 103          */
 104
 105         private static $owner;
 106
 107         /**
 108          * Returns the numeric account type by their string
 109          *
 110          * @param string $accounttype as string constant
 111          * @return int|null Numeric account type - or null when not set
 112          */
 113         public static function getAccountTypeByString(string $accounttype)
 114         {
 115                 switch ($accounttype) {
 116                         case 'person':
 117                                 return User::ACCOUNT_TYPE_PERSON;
 118                         case 'organisation':
 119                                 return User::ACCOUNT_TYPE_ORGANISATION;
 120                         case 'news':
 121                                 return User::ACCOUNT_TYPE_NEWS;
 122                         case 'community':
 123                                 return User::ACCOUNT_TYPE_COMMUNITY;
 124                         default:
 125                                 return null;
 126                         break;
 127                 }
 128         }
 129
 130         /**
 131          * Fetch the system account
 132          *
 133          * @return array system account
 134          */
 135         public static function getSystemAccount()
 136         {
 137                 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 138                 if (!DBA::isResult($system)) {
 139                         self::createSystemAccount();
 140                         $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 141                         if (!DBA::isResult($system)) {
 142                                 return [];
 143                         }
 144                 }
 145
 146                 $system['sprvkey'] = $system['uprvkey'] = $system['prvkey'];
 147                 $system['spubkey'] = $system['upubkey'] = $system['pubkey'];
 148                 $system['nickname'] = $system['nick'];
 149
 150                 // Ensure that the user contains data
 151                 $user = DBA::selectFirst('user', ['prvkey'], ['uid' => 0]);
 152                 if (empty($user['prvkey'])) {
 153                         $fields = [
 154                                 'username' => $system['name'],
 155                                 'nickname' => $system['nick'],
 156                                 'register_date' => $system['created'],
 157                                 'pubkey' => $system['pubkey'],
 158                                 'prvkey' => $system['prvkey'],
 159                                 'spubkey' => $system['spubkey'],
 160                                 'sprvkey' => $system['sprvkey'],
 161                                 'verified' => true,
 162                                 'page-flags' => User::PAGE_FLAGS_SOAPBOX,
 163                                 'account-type' => User::ACCOUNT_TYPE_RELAY,
 164                         ];
 165
 166                         DBA::update('user', $fields, ['uid' => 0]);
 167                 }
 168
 169                 return $system;
 170         }
 171
 172         /**
 173          * Create the system account
 174          *
 175          * @return void
 176          */
 177         private static function createSystemAccount()
 178         {
 179                 $system_actor_name = self::getActorName();
 180                 if (empty($system_actor_name)) {
 181                         return;
 182                 }
 183
 184                 $keys = Crypto::newKeypair(4096);
 185                 if ($keys === false) {
 186                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 187                 }
 188
 189                 $system = [];
 190                 $system['uid'] = 0;
 191                 $system['created'] = DateTimeFormat::utcNow();
 192                 $system['self'] = true;
 193                 $system['network'] = Protocol::ACTIVITYPUB;
 194                 $system['name'] = 'System Account';
 195                 $system['addr'] = $system_actor_name . '@' . DI::baseUrl()->getHostname();
 196                 $system['nick'] = $system_actor_name;
 197                 $system['url'] = DI::baseUrl() . '/friendica';
 198
 199                 $system['avatar'] = $system['photo'] = Contact::getDefaultAvatar($system, Proxy::SIZE_SMALL);
 200                 $system['thumb'] = Contact::getDefaultAvatar($system, Proxy::SIZE_THUMB);
 201                 $system['micro'] = Contact::getDefaultAvatar($system, Proxy::SIZE_MICRO);
 202
 203                 $system['nurl'] = Strings::normaliseLink($system['url']);
 204                 $system['pubkey'] = $keys['pubkey'];
 205                 $system['prvkey'] = $keys['prvkey'];
 206                 $system['blocked'] = 0;
 207                 $system['pending'] = 0;
 208                 $system['contact-type'] = Contact::TYPE_RELAY; // In AP this is translated to 'Application'
 209                 $system['name-date'] = DateTimeFormat::utcNow();
 210                 $system['uri-date'] = DateTimeFormat::utcNow();
 211                 $system['avatar-date'] = DateTimeFormat::utcNow();
 212                 $system['closeness'] = 0;
 213                 $system['baseurl'] = DI::baseUrl();
 214                 $system['gsid'] = GServer::getID($system['baseurl']);
 215                 DBA::insert('contact', $system);
 216         }
 217
 218         /**
 219          * Detect a usable actor name
 220          *
 221          * @return string actor account name
 222          */
 223         public static function getActorName()
 224         {
 225                 $system_actor_name = DI::config()->get('system', 'actor_name');
 226                 if (!empty($system_actor_name)) {
 227                         $self = Contact::selectFirst(['nick'], ['uid' => 0, 'self' => true]);
 228                         if (!empty($self['nick'])) {
 229                                 if ($self['nick'] != $system_actor_name) {
 230                                         // Reset the actor name to the already used name
 231                                         DI::config()->set('system', 'actor_name', $self['nick']);
 232                                         $system_actor_name = $self['nick'];
 233                                 }
 234                         }
 235                         return $system_actor_name;
 236                 }
 237
 238                 // List of possible actor names
 239                 $possible_accounts = ['friendica', 'actor', 'system', 'internal'];
 240                 foreach ($possible_accounts as $name) {
 241                         if (!DBA::exists('user', ['nickname' => $name, 'account_removed' => false, 'expire' => false]) &&
 242                                 !DBA::exists('userd', ['username' => $name])) {
 243                                 DI::config()->set('system', 'actor_name', $name);
 244                                 return $name;
 245                         }
 246                 }
 247                 return '';
 248         }
 249
 250         /**
 251          * Returns true if a user record exists with the provided id
 252          *
 253          * @param  integer $uid
 254          * @return boolean
 255          * @throws Exception
 256          */
 257         public static function exists($uid)
 258         {
 259                 return DBA::exists('user', ['uid' => $uid]);
 260         }
 261
 262         /**
 263          * @param  integer       $uid
 264          * @param array          $fields
 265          * @return array|boolean User record if it exists, false otherwise
 266          * @throws Exception
 267          */
 268         public static function getById($uid, array $fields = [])
 269         {
 270                 return !empty($uid) ? DBA::selectFirst('user', $fields, ['uid' => $uid]) : [];
 271         }
 272
 273         /**
 274          * Returns a user record based on it's GUID
 275          *
 276          * @param string $guid   The guid of the user
 277          * @param array  $fields The fields to retrieve
 278          * @param bool   $active True, if only active records are searched
 279          *
 280          * @return array|boolean User record if it exists, false otherwise
 281          * @throws Exception
 282          */
 283         public static function getByGuid(string $guid, array $fields = [], bool $active = true)
 284         {
 285                 if ($active) {
 286                         $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
 287                 } else {
 288                         $cond = ['guid' => $guid];
 289                 }
 290
 291                 return DBA::selectFirst('user', $fields, $cond);
 292         }
 293
 294         /**
 295          * @param  string        $nickname
 296          * @param array          $fields
 297          * @return array|boolean User record if it exists, false otherwise
 298          * @throws Exception
 299          */
 300         public static function getByNickname($nickname, array $fields = [])
 301         {
 302                 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
 303         }
 304
 305         /**
 306          * Returns the user id of a given profile URL
 307          *
 308          * @param string $url
 309          *
 310          * @return integer user id
 311          * @throws Exception
 312          */
 313         public static function getIdForURL(string $url)
 314         {
 315                 // Avoid any database requests when the hostname isn't even part of the url.
 316                 if (!strpos($url, DI::baseUrl()->getHostname())) {
 317                         return 0;
 318                 }
 319
 320                 $self = Contact::selectFirst(['uid'], ['self' => true, 'nurl' => Strings::normaliseLink($url)]);
 321                 if (!empty($self['uid'])) {
 322                         return $self['uid'];
 323                 }
 324
 325                 $self = Contact::selectFirst(['uid'], ['self' => true, 'addr' => $url]);
 326                 if (!empty($self['uid'])) {
 327                         return $self['uid'];
 328                 }
 329
 330                 $self = Contact::selectFirst(['uid'], ['self' => true, 'alias' => [$url, Strings::normaliseLink($url)]]);
 331                 if (!empty($self['uid'])) {
 332                         return $self['uid'];
 333                 }
 334
 335                 return 0;
 336         }
 337
 338         /**
 339          * Get a user based on its email
 340          *
 341          * @param string        $email
 342          * @param array          $fields
 343          *
 344          * @return array|boolean User record if it exists, false otherwise
 345          *
 346          * @throws Exception
 347          */
 348         public static function getByEmail($email, array $fields = [])
 349         {
 350                 return DBA::selectFirst('user', $fields, ['email' => $email]);
 351         }
 352
 353         /**
 354          * Fetch the user array of the administrator. The first one if there are several.
 355          *
 356          * @param array $fields
 357          * @return array user
 358          */
 359         public static function getFirstAdmin(array $fields = [])
 360         {
 361                 if (!empty(DI::config()->get('config', 'admin_nickname'))) {
 362                         return self::getByNickname(DI::config()->get('config', 'admin_nickname'), $fields);
 363                 } elseif (!empty(DI::config()->get('config', 'admin_email'))) {
 364                         $adminList = explode(',', str_replace(' ', '', DI::config()->get('config', 'admin_email')));
 365                         return self::getByEmail($adminList[0], $fields);
 366                 } else {
 367                         return [];
 368                 }
 369         }
 370
 371         /**
 372          * Get owner data by user id
 373          *
 374          * @param int     $uid
 375          * @param boolean $repairMissing Repair the owner data if it's missing
 376          * @return boolean|array
 377          * @throws Exception
 378          */
 379         public static function getOwnerDataById(int $uid, bool $repairMissing = true)
 380         {
 381                 if ($uid == 0) {
 382                         return self::getSystemAccount();
 383                 }
 384
 385                 if (!empty(self::$owner[$uid])) {
 386                         return self::$owner[$uid];
 387                 }
 388
 389                 $owner = DBA::selectFirst('owner-view', [], ['uid' => $uid]);
 390                 if (!DBA::isResult($owner)) {
 391                         if (!DBA::exists('user', ['uid' => $uid]) || !$repairMissing) {
 392                                 return false;
 393                         }
 394                         Contact::createSelfFromUserId($uid);
 395                         $owner = self::getOwnerDataById($uid, false);
 396                 }
 397
 398                 if (empty($owner['nickname'])) {
 399                         return false;
 400                 }
 401
 402                 if (!$repairMissing || $owner['account_expired']) {
 403                         return $owner;
 404                 }
 405
 406                 // Check if the returned data is valid, otherwise fix it. See issue #6122
 407
 408                 // Check for correct url and normalised nurl
 409                 $url = DI::baseUrl() . '/profile/' . $owner['nickname'];
 410                 $repair = ($owner['url'] != $url) || ($owner['nurl'] != Strings::normaliseLink($owner['url']));
 411
 412                 if (!$repair) {
 413                         // Check if "addr" is present and correct
 414                         $addr = $owner['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
 415                         $repair = ($addr != $owner['addr']) || empty($owner['prvkey']) || empty($owner['pubkey']);
 416                 }
 417
 418                 if (!$repair) {
 419                         // Check if the avatar field is filled and the photo directs to the correct path
 420                         $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
 421                         if (DBA::isResult($avatar)) {
 422                                 $repair = empty($owner['avatar']) || !strpos($owner['photo'], $avatar['resource-id']);
 423                         }
 424                 }
 425
 426                 if ($repair) {
 427                         Contact::updateSelfFromUserID($uid);
 428                         // Return the corrected data and avoid a loop
 429                         $owner = self::getOwnerDataById($uid, false);
 430                 }
 431
 432                 self::$owner[$uid] = $owner;
 433                 return $owner;
 434         }
 435
 436         /**
 437          * Get owner data by nick name
 438          *
 439          * @param int $nick
 440          * @return boolean|array
 441          * @throws Exception
 442          */
 443         public static function getOwnerDataByNick($nick)
 444         {
 445                 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
 446
 447                 if (!DBA::isResult($user)) {
 448                         return false;
 449                 }
 450
 451                 return self::getOwnerDataById($user['uid']);
 452         }
 453
 454         /**
 455          * Returns the default group for a given user and network
 456          *
 457          * @param int    $uid     User id
 458          * @param string $network network name
 459          *
 460          * @return int group id
 461          * @throws Exception
 462          */
 463         public static function getDefaultGroup($uid, $network = '')
 464         {
 465                 $default_group = 0;
 466
 467                 if ($network == Protocol::OSTATUS) {
 468                         $default_group = DI::pConfig()->get($uid, "ostatus", "default_group");
 469                 }
 470
 471                 if ($default_group != 0) {
 472                         return $default_group;
 473                 }
 474
 475                 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
 476
 477                 if (DBA::isResult($user)) {
 478                         $default_group = $user["def_gid"];
 479                 }
 480
 481                 return $default_group;
 482         }
 483
 484
 485         /**
 486          * Authenticate a user with a clear text password
 487          *
 488          * @param mixed  $user_info
 489          * @param string $password
 490          * @param bool   $third_party
 491          * @return int|boolean
 492          * @deprecated since version 3.6
 493          * @see        User::getIdFromPasswordAuthentication()
 494          */
 495         public static function authenticate($user_info, $password, $third_party = false)
 496         {
 497                 try {
 498                         return self::getIdFromPasswordAuthentication($user_info, $password, $third_party);
 499                 } catch (Exception $ex) {
 500                         return false;
 501                 }
 502         }
 503
 504         /**
 505          * Authenticate a user with a clear text password
 506          *
 507          * Returns the user id associated with a successful password authentication
 508          *
 509          * @param mixed  $user_info
 510          * @param string $password
 511          * @param bool   $third_party
 512          * @return int User Id if authentication is successful
 513          * @throws HTTPException\ForbiddenException
 514          * @throws HTTPException\NotFoundException
 515          */
 516         public static function getIdFromPasswordAuthentication($user_info, $password, $third_party = false)
 517         {
 518                 $user = self::getAuthenticationInfo($user_info);
 519
 520                 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
 521                         // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
 522                         if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
 523                                 return $user['uid'];
 524                         }
 525                 } elseif (strpos($user['password'], '$') === false) {
 526                         //Legacy hash that has not been replaced by a new hash yet
 527                         if (self::hashPasswordLegacy($password) === $user['password']) {
 528                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 529
 530                                 return $user['uid'];
 531                         }
 532                 } elseif (!empty($user['legacy_password'])) {
 533                         //Legacy hash that has been double-hashed and not replaced by a new hash yet
 534                         //Warning: `legacy_password` is not necessary in sync with the content of `password`
 535                         if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
 536                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 537
 538                                 return $user['uid'];
 539                         }
 540                 } elseif (password_verify($password, $user['password'])) {
 541                         //New password hash
 542                         if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
 543                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 544                         }
 545
 546                         return $user['uid'];
 547                 } else {
 548                         $addon_auth = [
 549                                 'username'      => $user['nickname'],
 550                                 'password'      => $password,
 551                                 'authenticated' => 0,
 552                                 'user_record'   => null
 553                         ];
 554
 555                         /*
 556                          * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
 557                          * Addons should never set 'authenticated' except to indicate success - as hooks may be chained
 558                          * and later addons should not interfere with an earlier one that succeeded.
 559                          */
 560                         Hook::callAll('authenticate', $addon_auth);
 561
 562                         if ($addon_auth['authenticated'] && $addon_auth['user_record']) {
 563                                 return $user['uid'];
 564                         }
 565                 }
 566
 567                 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
 568         }
 569
 570         /**
 571          * Returns authentication info from various parameters types
 572          *
 573          * User info can be any of the following:
 574          * - User DB object
 575          * - User Id
 576          * - User email or username or nickname
 577          * - User array with at least the uid and the hashed password
 578          *
 579          * @param mixed $user_info
 580          * @return array
 581          * @throws HTTPException\NotFoundException
 582          */
 583         public static function getAuthenticationInfo($user_info)
 584         {
 585                 $user = null;
 586
 587                 if (is_object($user_info) || is_array($user_info)) {
 588                         if (is_object($user_info)) {
 589                                 $user = (array) $user_info;
 590                         } else {
 591                                 $user = $user_info;
 592                         }
 593
 594                         if (
 595                                 !isset($user['uid'])
 596                                 || !isset($user['password'])
 597                                 || !isset($user['legacy_password'])
 598                         ) {
 599                                 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
 600                         }
 601                 } elseif (is_int($user_info) || is_string($user_info)) {
 602                         if (is_int($user_info)) {
 603                                 $user = DBA::selectFirst(
 604                                         'user',
 605                                         ['uid', 'nickname', 'password', 'legacy_password'],
 606                                         [
 607                                                 'uid' => $user_info,
 608                                                 'blocked' => 0,
 609                                                 'account_expired' => 0,
 610                                                 'account_removed' => 0,
 611                                                 'verified' => 1
 612                                         ]
 613                                 );
 614                         } else {
 615                                 $fields = ['uid', 'nickname', 'password', 'legacy_password'];
 616                                 $condition = [
 617                                         "(`email` = ? OR `username` = ? OR `nickname` = ?)
 618                                         AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
 619                                         $user_info, $user_info, $user_info
 620                                 ];
 621                                 $user = DBA::selectFirst('user', $fields, $condition);
 622                         }
 623
 624                         if (!DBA::isResult($user)) {
 625                                 throw new HTTPException\NotFoundException(DI::l10n()->t('User not found'));
 626                         }
 627                 }
 628
 629                 return $user;
 630         }
 631
 632         /**
 633          * Generates a human-readable random password
 634          *
 635          * @return string
 636          * @throws Exception
 637          */
 638         public static function generateNewPassword()
 639         {
 640                 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
 641         }
 642
 643         /**
 644          * Checks if the provided plaintext password has been exposed or not
 645          *
 646          * @param string $password
 647          * @return bool
 648          * @throws Exception
 649          */
 650         public static function isPasswordExposed($password)
 651         {
 652                 $cache = new CacheItemPool();
 653                 $cache->changeConfig([
 654                         'cacheDirectory' => get_temppath() . '/password-exposed-cache/',
 655                 ]);
 656
 657                 try {
 658                         $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
 659
 660                         return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
 661                 } catch (Exception $e) {
 662                         Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
 663                                 'code' => $e->getCode(),
 664                                 'file' => $e->getFile(),
 665                                 'line' => $e->getLine(),
 666                                 'trace' => $e->getTraceAsString()
 667                         ]);
 668
 669                         return false;
 670                 }
 671         }
 672
 673         /**
 674          * Legacy hashing function, kept for password migration purposes
 675          *
 676          * @param string $password
 677          * @return string
 678          */
 679         private static function hashPasswordLegacy($password)
 680         {
 681                 return hash('whirlpool', $password);
 682         }
 683
 684         /**
 685          * Global user password hashing function
 686          *
 687          * @param string $password
 688          * @return string
 689          * @throws Exception
 690          */
 691         public static function hashPassword($password)
 692         {
 693                 if (!trim($password)) {
 694                         throw new Exception(DI::l10n()->t('Password can\'t be empty'));
 695                 }
 696
 697                 return password_hash($password, PASSWORD_DEFAULT);
 698         }
 699
 700         /**
 701          * Updates a user row with a new plaintext password
 702          *
 703          * @param int    $uid
 704          * @param string $password
 705          * @return bool
 706          * @throws Exception
 707          */
 708         public static function updatePassword($uid, $password)
 709         {
 710                 $password = trim($password);
 711
 712                 if (empty($password)) {
 713                         throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
 714                 }
 715
 716                 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
 717                         throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
 718                 }
 719
 720                 $allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
 721
 722                 if (!preg_match('/^[a-z0-9' . preg_quote($allowed_characters, '/') . ']+$/i', $password)) {
 723                         throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
 724                 }
 725
 726                 return self::updatePasswordHashed($uid, self::hashPassword($password));
 727         }
 728
 729         /**
 730          * Updates a user row with a new hashed password.
 731          * Empties the password reset token field just in case.
 732          *
 733          * @param int    $uid
 734          * @param string $pasword_hashed
 735          * @return bool
 736          * @throws Exception
 737          */
 738         private static function updatePasswordHashed($uid, $pasword_hashed)
 739         {
 740                 $fields = [
 741                         'password' => $pasword_hashed,
 742                         'pwdreset' => null,
 743                         'pwdreset_time' => null,
 744                         'legacy_password' => false
 745                 ];
 746                 return DBA::update('user', $fields, ['uid' => $uid]);
 747         }
 748
 749         /**
 750          * Checks if a nickname is in the list of the forbidden nicknames
 751          *
 752          * Check if a nickname is forbidden from registration on the node by the
 753          * admin. Forbidden nicknames (e.g. role namess) can be configured in the
 754          * admin panel.
 755          *
 756          * @param string $nickname The nickname that should be checked
 757          * @return boolean True is the nickname is blocked on the node
 758          */
 759         public static function isNicknameBlocked($nickname)
 760         {
 761                 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
 762                 if (!empty($forbidden_nicknames)) {
 763                         $forbidden = explode(',', $forbidden_nicknames);
 764                         $forbidden = array_map('trim', $forbidden);
 765                 } else {
 766                         $forbidden = [];
 767                 }
 768
 769                 // Add the name of the internal actor to the "forbidden" list
 770                 $actor_name = self::getActorName();
 771                 if (!empty($actor_name)) {
 772                         $forbidden[] = $actor_name;
 773                 }
 774
 775                 if (empty($forbidden)) {
 776                         return false;
 777                 }
 778
 779                 // check if the nickname is in the list of blocked nicknames
 780                 if (in_array(strtolower($nickname), $forbidden)) {
 781                         return true;
 782                 }
 783
 784                 // else return false
 785                 return false;
 786         }
 787
 788         /**
 789          * Catch-all user creation function
 790          *
 791          * Creates a user from the provided data array, either form fields or OpenID.
 792          * Required: { username, nickname, email } or { openid_url }
 793          *
 794          * Performs the following:
 795          * - Sends to the OpenId auth URL (if relevant)
 796          * - Creates new key pairs for crypto
 797          * - Create self-contact
 798          * - Create profile image
 799          *
 800          * @param  array $data
 801          * @return array
 802          * @throws ErrorException
 803          * @throws HTTPException\InternalServerErrorException
 804          * @throws ImagickException
 805          * @throws Exception
 806          */
 807         public static function create(array $data)
 808         {
 809                 $return = ['user' => null, 'password' => ''];
 810
 811                 $using_invites = DI::config()->get('system', 'invitation_only');
 812
 813                 $invite_id  = !empty($data['invite_id'])  ? Strings::escapeTags(trim($data['invite_id']))  : '';
 814                 $username   = !empty($data['username'])   ? Strings::escapeTags(trim($data['username']))   : '';
 815                 $nickname   = !empty($data['nickname'])   ? Strings::escapeTags(trim($data['nickname']))   : '';
 816                 $email      = !empty($data['email'])      ? Strings::escapeTags(trim($data['email']))      : '';
 817                 $openid_url = !empty($data['openid_url']) ? Strings::escapeTags(trim($data['openid_url'])) : '';
 818                 $photo      = !empty($data['photo'])      ? Strings::escapeTags(trim($data['photo']))      : '';
 819                 $password   = !empty($data['password'])   ? trim($data['password'])           : '';
 820                 $password1  = !empty($data['password1'])  ? trim($data['password1'])          : '';
 821                 $confirm    = !empty($data['confirm'])    ? trim($data['confirm'])            : '';
 822                 $blocked    = !empty($data['blocked']);
 823                 $verified   = !empty($data['verified']);
 824                 $language   = !empty($data['language'])   ? Strings::escapeTags(trim($data['language']))   : 'en';
 825
 826                 $netpublish = $publish = !empty($data['profile_publish_reg']);
 827
 828                 if ($password1 != $confirm) {
 829                         throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
 830                 } elseif ($password1 != '') {
 831                         $password = $password1;
 832                 }
 833
 834                 if ($using_invites) {
 835                         if (!$invite_id) {
 836                                 throw new Exception(DI::l10n()->t('An invitation is required.'));
 837                         }
 838
 839                         if (!Register::existsByHash($invite_id)) {
 840                                 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
 841                         }
 842                 }
 843
 844                 /// @todo Check if this part is really needed. We should have fetched all this data in advance
 845                 if (empty($username) || empty($email) || empty($nickname)) {
 846                         if ($openid_url) {
 847                                 if (!Network::isUrlValid($openid_url)) {
 848                                         throw new Exception(DI::l10n()->t('Invalid OpenID url'));
 849                                 }
 850                                 $_SESSION['register'] = 1;
 851                                 $_SESSION['openid'] = $openid_url;
 852
 853                                 $openid = new LightOpenID(DI::baseUrl()->getHostname());
 854                                 $openid->identity = $openid_url;
 855                                 $openid->returnUrl = DI::baseUrl() . '/openid';
 856                                 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
 857                                 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
 858                                 try {
 859                                         $authurl = $openid->authUrl();
 860                                 } catch (Exception $e) {
 861                                         throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . EOL . EOL . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
 862                                 }
 863                                 System::externalRedirect($authurl);
 864                                 // NOTREACHED
 865                         }
 866
 867                         throw new Exception(DI::l10n()->t('Please enter the required information.'));
 868                 }
 869
 870                 if (!Network::isUrlValid($openid_url)) {
 871                         $openid_url = '';
 872                 }
 873
 874                 // collapse multiple spaces in name
 875                 $username = preg_replace('/ +/', ' ', $username);
 876
 877                 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
 878                 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
 879
 880                 if ($username_min_length > $username_max_length) {
 881                         Logger::log(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length), Logger::WARNING);
 882                         $tmp = $username_min_length;
 883                         $username_min_length = $username_max_length;
 884                         $username_max_length = $tmp;
 885                 }
 886
 887                 if (mb_strlen($username) < $username_min_length) {
 888                         throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
 889                 }
 890
 891                 if (mb_strlen($username) > $username_max_length) {
 892                         throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
 893                 }
 894
 895                 // So now we are just looking for a space in the full name.
 896                 $loose_reg = DI::config()->get('system', 'no_regfullname');
 897                 if (!$loose_reg) {
 898                         $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
 899                         if (strpos($username, ' ') === false) {
 900                                 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
 901                         }
 902                 }
 903
 904                 if (!Network::isEmailDomainAllowed($email)) {
 905                         throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
 906                 }
 907
 908                 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
 909                         throw new Exception(DI::l10n()->t('Not a valid email address.'));
 910                 }
 911                 if (self::isNicknameBlocked($nickname)) {
 912                         throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
 913                 }
 914
 915                 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
 916                         throw new Exception(DI::l10n()->t('Cannot use that email.'));
 917                 }
 918
 919                 // Disallow somebody creating an account using openid that uses the admin email address,
 920                 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
 921                 if (DI::config()->get('config', 'admin_email') && strlen($openid_url)) {
 922                         $adminlist = explode(',', str_replace(' ', '', strtolower(DI::config()->get('config', 'admin_email'))));
 923                         if (in_array(strtolower($email), $adminlist)) {
 924                                 throw new Exception(DI::l10n()->t('Cannot use that email.'));
 925                         }
 926                 }
 927
 928                 $nickname = $data['nickname'] = strtolower($nickname);
 929
 930                 if (!preg_match('/^[a-z0-9][a-z0-9_]*$/', $nickname)) {
 931                         throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
 932                 }
 933
 934                 // Check existing and deleted accounts for this nickname.
 935                 if (
 936                         DBA::exists('user', ['nickname' => $nickname])
 937                         || DBA::exists('userd', ['username' => $nickname])
 938                 ) {
 939                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
 940                 }
 941
 942                 $new_password = strlen($password) ? $password : User::generateNewPassword();
 943                 $new_password_encoded = self::hashPassword($new_password);
 944
 945                 $return['password'] = $new_password;
 946
 947                 $keys = Crypto::newKeypair(4096);
 948                 if ($keys === false) {
 949                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 950                 }
 951
 952                 $prvkey = $keys['prvkey'];
 953                 $pubkey = $keys['pubkey'];
 954
 955                 // Create another keypair for signing/verifying salmon protocol messages.
 956                 $sres = Crypto::newKeypair(512);
 957                 $sprvkey = $sres['prvkey'];
 958                 $spubkey = $sres['pubkey'];
 959
 960                 $insert_result = DBA::insert('user', [
 961                         'guid'     => System::createUUID(),
 962                         'username' => $username,
 963                         'password' => $new_password_encoded,
 964                         'email'    => $email,
 965                         'openid'   => $openid_url,
 966                         'nickname' => $nickname,
 967                         'pubkey'   => $pubkey,
 968                         'prvkey'   => $prvkey,
 969                         'spubkey'  => $spubkey,
 970                         'sprvkey'  => $sprvkey,
 971                         'verified' => $verified,
 972                         'blocked'  => $blocked,
 973                         'language' => $language,
 974                         'timezone' => 'UTC',
 975                         'register_date' => DateTimeFormat::utcNow(),
 976                         'default-location' => ''
 977                 ]);
 978
 979                 if ($insert_result) {
 980                         $uid = DBA::lastInsertId();
 981                         $user = DBA::selectFirst('user', [], ['uid' => $uid]);
 982                 } else {
 983                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
 984                 }
 985
 986                 if (!$uid) {
 987                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
 988                 }
 989
 990                 // if somebody clicked submit twice very quickly, they could end up with two accounts
 991                 // due to race condition. Remove this one.
 992                 $user_count = DBA::count('user', ['nickname' => $nickname]);
 993                 if ($user_count > 1) {
 994                         DBA::delete('user', ['uid' => $uid]);
 995
 996                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
 997                 }
 998
 999                 $insert_result = DBA::insert('profile', [
1000                         'uid' => $uid,
1001                         'name' => $username,
1002                         'photo' => DI::baseUrl() . "/photo/profile/{$uid}.jpg",
1003                         'thumb' => DI::baseUrl() . "/photo/avatar/{$uid}.jpg",
1004                         'publish' => $publish,
1005                         'net-publish' => $netpublish,
1006                 ]);
1007                 if (!$insert_result) {
1008                         DBA::delete('user', ['uid' => $uid]);
1009
1010                         throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
1011                 }
1012
1013                 // Create the self contact
1014                 if (!Contact::createSelfFromUserId($uid)) {
1015                         DBA::delete('user', ['uid' => $uid]);
1016
1017                         throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
1018                 }
1019
1020                 // Create a group with no members. This allows somebody to use it
1021                 // right away as a default group for new contacts.
1022                 $def_gid = Group::create($uid, DI::l10n()->t('Friends'));
1023                 if (!$def_gid) {
1024                         DBA::delete('user', ['uid' => $uid]);
1025
1026                         throw new Exception(DI::l10n()->t('An error occurred creating your default contact group. Please try again.'));
1027                 }
1028
1029                 $fields = ['def_gid' => $def_gid];
1030                 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
1031                         $fields['allow_gid'] = '<' . $def_gid . '>';
1032                 }
1033
1034                 DBA::update('user', $fields, ['uid' => $uid]);
1035
1036                 // if we have no OpenID photo try to look up an avatar
1037                 if (!strlen($photo)) {
1038                         $photo = Network::lookupAvatarByEmail($email);
1039                 }
1040
1041                 // unless there is no avatar-addon loaded
1042                 if (strlen($photo)) {
1043                         $photo_failure = false;
1044
1045                         $filename = basename($photo);
1046                         $curlResult = DI::httpRequest()->get($photo);
1047                         if ($curlResult->isSuccess()) {
1048                                 $img_str = $curlResult->getBody();
1049                                 $type = $curlResult->getContentType();
1050                         } else {
1051                                 $img_str = '';
1052                                 $type = '';
1053                         }
1054
1055                         $type = Images::getMimeTypeByData($img_str, $photo, $type);
1056
1057                         $Image = new Image($img_str, $type);
1058                         if ($Image->isValid()) {
1059                                 $Image->scaleToSquare(300);
1060
1061                                 $resource_id = Photo::newResource();
1062
1063                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 4);
1064
1065                                 if ($r === false) {
1066                                         $photo_failure = true;
1067                                 }
1068
1069                                 $Image->scaleDown(80);
1070
1071                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 5);
1072
1073                                 if ($r === false) {
1074                                         $photo_failure = true;
1075                                 }
1076
1077                                 $Image->scaleDown(48);
1078
1079                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 6);
1080
1081                                 if ($r === false) {
1082                                         $photo_failure = true;
1083                                 }
1084
1085                                 if (!$photo_failure) {
1086                                         Photo::update(['profile' => 1], ['resource-id' => $resource_id]);
1087                                 }
1088                         }
1089                 }
1090
1091                 Hook::callAll('register_account', $uid);
1092
1093                 $return['user'] = $user;
1094                 return $return;
1095         }
1096
1097         /**
1098          * Sets block state for a given user
1099          *
1100          * @param int  $uid   The user id
1101          * @param bool $block Block state (default is true)
1102          *
1103          * @return bool True, if successfully blocked
1104
1105          * @throws Exception
1106          */
1107         public static function block(int $uid, bool $block = true)
1108         {
1109                 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
1110         }
1111
1112         /**
1113          * Allows a registration based on a hash
1114          *
1115          * @param string $hash
1116          *
1117          * @return bool True, if the allow was successful
1118          *
1119          * @throws HTTPException\InternalServerErrorException
1120          * @throws Exception
1121          */
1122         public static function allow(string $hash)
1123         {
1124                 $register = Register::getByHash($hash);
1125                 if (!DBA::isResult($register)) {
1126                         return false;
1127                 }
1128
1129                 $user = User::getById($register['uid']);
1130                 if (!DBA::isResult($user)) {
1131                         return false;
1132                 }
1133
1134                 Register::deleteByHash($hash);
1135
1136                 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
1137
1138                 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
1139
1140                 if (DBA::isResult($profile) && $profile['net-publish'] && DI::config()->get('system', 'directory')) {
1141                         $url = DI::baseUrl() . '/profile/' . $user['nickname'];
1142                         Worker::add(PRIORITY_LOW, "Directory", $url);
1143                 }
1144
1145                 $l10n = DI::l10n()->withLang($register['language']);
1146
1147                 return User::sendRegisterOpenEmail(
1148                         $l10n,
1149                         $user,
1150                         DI::config()->get('config', 'sitename'),
1151                         DI::baseUrl()->get(),
1152                         ($register['password'] ?? '') ?: 'Sent in a previous email'
1153                 );
1154         }
1155
1156         /**
1157          * Denys a pending registration
1158          *
1159          * @param string $hash The hash of the pending user
1160          *
1161          * This does not have to go through user_remove() and save the nickname
1162          * permanently against re-registration, as the person was not yet
1163          * allowed to have friends on this system
1164          *
1165          * @return bool True, if the deny was successfull
1166          * @throws Exception
1167          */
1168         public static function deny(string $hash)
1169         {
1170                 $register = Register::getByHash($hash);
1171                 if (!DBA::isResult($register)) {
1172                         return false;
1173                 }
1174
1175                 $user = User::getById($register['uid']);
1176                 if (!DBA::isResult($user)) {
1177                         return false;
1178                 }
1179
1180                 // Delete the avatar
1181                 Photo::delete(['uid' => $register['uid']]);
1182
1183                 return DBA::delete('user', ['uid' => $register['uid']]) &&
1184                        Register::deleteByHash($register['hash']);
1185         }
1186
1187         /**
1188          * Creates a new user based on a minimal set and sends an email to this user
1189          *
1190          * @param string $name  The user's name
1191          * @param string $email The user's email address
1192          * @param string $nick  The user's nick name
1193          * @param string $lang  The user's language (default is english)
1194          *
1195          * @return bool True, if the user was created successfully
1196          * @throws HTTPException\InternalServerErrorException
1197          * @throws ErrorException
1198          * @throws ImagickException
1199          */
1200         public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT)
1201         {
1202                 if (empty($name) ||
1203                     empty($email) ||
1204                     empty($nick)) {
1205                         throw new HTTPException\InternalServerErrorException('Invalid arguments.');
1206                 }
1207
1208                 $result = self::create([
1209                         'username' => $name,
1210                         'email' => $email,
1211                         'nickname' => $nick,
1212                         'verified' => 1,
1213                         'language' => $lang
1214                 ]);
1215
1216                 $user = $result['user'];
1217                 $preamble = Strings::deindent(DI::l10n()->t('
1218                 Dear %1$s,
1219                         the administrator of %2$s has set up an account for you.'));
1220                 $body = Strings::deindent(DI::l10n()->t('
1221                 The login details are as follows:
1222
1223                 Site Location:  %1$s
1224                 Login Name:             %2$s
1225                 Password:               %3$s
1226
1227                 You may change your password from your account "Settings" page after logging
1228                 in.
1229
1230                 Please take a few moments to review the other account settings on that page.
1231
1232                 You may also wish to add some basic information to your default profile
1233                 (on the "Profiles" page) so that other people can easily find you.
1234
1235                 We recommend setting your full name, adding a profile photo,
1236                 adding some profile "keywords" (very useful in making new friends) - and
1237                 perhaps what country you live in; if you do not wish to be more specific
1238                 than that.
1239
1240                 We fully respect your right to privacy, and none of these items are necessary.
1241                 If you are new and do not know anybody here, they may help
1242                 you to make some new and interesting friends.
1243
1244                 If you ever want to delete your account, you can do so at %1$s/removeme
1245
1246                 Thank you and welcome to %4$s.'));
1247
1248                 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1249                 $body = sprintf($body, DI::baseUrl()->get(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1250
1251                 $email = DI::emailer()
1252                         ->newSystemMail()
1253                         ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1254                         ->forUser($user)
1255                         ->withRecipient($user['email'])
1256                         ->build();
1257                 return DI::emailer()->send($email);
1258         }
1259
1260         /**
1261          * Sends pending registration confirmation email
1262          *
1263          * @param array  $user     User record array
1264          * @param string $sitename
1265          * @param string $siteurl
1266          * @param string $password Plaintext password
1267          * @return NULL|boolean from notification() and email() inherited
1268          * @throws HTTPException\InternalServerErrorException
1269          */
1270         public static function sendRegisterPendingEmail($user, $sitename, $siteurl, $password)
1271         {
1272                 $body = Strings::deindent(DI::l10n()->t(
1273                         '
1274                         Dear %1$s,
1275                                 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1276
1277                         Your login details are as follows:
1278
1279                         Site Location:  %3$s
1280                         Login Name:             %4$s
1281                         Password:               %5$s
1282                 ',
1283                         $user['username'],
1284                         $sitename,
1285                         $siteurl,
1286                         $user['nickname'],
1287                         $password
1288                 ));
1289
1290                 $email = DI::emailer()
1291                         ->newSystemMail()
1292                         ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1293                         ->forUser($user)
1294                         ->withRecipient($user['email'])
1295                         ->build();
1296                 return DI::emailer()->send($email);
1297         }
1298
1299         /**
1300          * Sends registration confirmation
1301          *
1302          * It's here as a function because the mail is sent from different parts
1303          *
1304          * @param L10n   $l10n     The used language
1305          * @param array  $user     User record array
1306          * @param string $sitename
1307          * @param string $siteurl
1308          * @param string $password Plaintext password
1309          *
1310          * @return NULL|boolean from notification() and email() inherited
1311          * @throws HTTPException\InternalServerErrorException
1312          */
1313         public static function sendRegisterOpenEmail(L10n $l10n, $user, $sitename, $siteurl, $password)
1314         {
1315                 $preamble = Strings::deindent($l10n->t(
1316                         '
1317                                 Dear %1$s,
1318                                 Thank you for registering at %2$s. Your account has been created.
1319                         ',
1320                         $user['username'],
1321                         $sitename
1322                 ));
1323                 $body = Strings::deindent($l10n->t(
1324                         '
1325                         The login details are as follows:
1326
1327                         Site Location:  %3$s
1328                         Login Name:             %1$s
1329                         Password:               %5$s
1330
1331                         You may change your password from your account "Settings" page after logging
1332                         in.
1333
1334                         Please take a few moments to review the other account settings on that page.
1335
1336                         You may also wish to add some basic information to your default profile
1337                         ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1338
1339                         We recommend setting your full name, adding a profile photo,
1340                         adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1341                         perhaps what country you live in; if you do not wish to be more specific
1342                         than that.
1343
1344                         We fully respect your right to privacy, and none of these items are necessary.
1345                         If you are new and do not know anybody here, they may help
1346                         you to make some new and interesting friends.
1347
1348                         If you ever want to delete your account, you can do so at %3$s/removeme
1349
1350                         Thank you and welcome to %2$s.',
1351                         $user['nickname'],
1352                         $sitename,
1353                         $siteurl,
1354                         $user['username'],
1355                         $password
1356                 ));
1357
1358                 $email = DI::emailer()
1359                         ->newSystemMail()
1360                         ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1361                         ->forUser($user)
1362                         ->withRecipient($user['email'])
1363                         ->build();
1364                 return DI::emailer()->send($email);
1365         }
1366
1367         /**
1368          * @param int $uid user to remove
1369          * @return bool
1370          * @throws HTTPException\InternalServerErrorException
1371          */
1372         public static function remove(int $uid)
1373         {
1374                 if (empty($uid)) {
1375                         return false;
1376                 }
1377
1378                 Logger::log('Removing user: ' . $uid);
1379
1380                 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1381
1382                 Hook::callAll('remove_user', $user);
1383
1384                 // save username (actually the nickname as it is guaranteed
1385                 // unique), so it cannot be re-registered in the future.
1386                 DBA::insert('userd', ['username' => $user['nickname']]);
1387
1388                 // Remove all personal settings, especially connector settings
1389                 DBA::delete('pconfig', ['uid' => $uid]);
1390
1391                 // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
1392                 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1393                 Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1394
1395                 // Send an update to the directory
1396                 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1397                 Worker::add(PRIORITY_LOW, 'Directory', $self['url']);
1398
1399                 // Remove the user relevant data
1400                 Worker::add(PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1401
1402                 return true;
1403         }
1404
1405         /**
1406          * Return all identities to a user
1407          *
1408          * @param int $uid The user id
1409          * @return array All identities for this user
1410          *
1411          * Example for a return:
1412          *    [
1413          *        [
1414          *            'uid' => 1,
1415          *            'username' => 'maxmuster',
1416          *            'nickname' => 'Max Mustermann'
1417          *        ],
1418          *        [
1419          *            'uid' => 2,
1420          *            'username' => 'johndoe',
1421          *            'nickname' => 'John Doe'
1422          *        ]
1423          *    ]
1424          * @throws Exception
1425          */
1426         public static function identities($uid)
1427         {
1428                 $identities = [];
1429
1430                 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1431                 if (!DBA::isResult($user)) {
1432                         return $identities;
1433                 }
1434
1435                 if ($user['parent-uid'] == 0) {
1436                         // First add our own entry
1437                         $identities = [[
1438                                 'uid' => $user['uid'],
1439                                 'username' => $user['username'],
1440                                 'nickname' => $user['nickname']
1441                         ]];
1442
1443                         // Then add all the children
1444                         $r = DBA::select(
1445                                 'user',
1446                                 ['uid', 'username', 'nickname'],
1447                                 ['parent-uid' => $user['uid'], 'account_removed' => false]
1448                         );
1449                         if (DBA::isResult($r)) {
1450                                 $identities = array_merge($identities, DBA::toArray($r));
1451                         }
1452                 } else {
1453                         // First entry is our parent
1454                         $r = DBA::select(
1455                                 'user',
1456                                 ['uid', 'username', 'nickname'],
1457                                 ['uid' => $user['parent-uid'], 'account_removed' => false]
1458                         );
1459                         if (DBA::isResult($r)) {
1460                                 $identities = DBA::toArray($r);
1461                         }
1462
1463                         // Then add all siblings
1464                         $r = DBA::select(
1465                                 'user',
1466                                 ['uid', 'username', 'nickname'],
1467                                 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1468                         );
1469                         if (DBA::isResult($r)) {
1470                                 $identities = array_merge($identities, DBA::toArray($r));
1471                         }
1472                 }
1473
1474                 $r = DBA::p(
1475                         "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1476                         FROM `manage`
1477                         INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1478                         WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1479                         $user['uid']
1480                 );
1481                 if (DBA::isResult($r)) {
1482                         $identities = array_merge($identities, DBA::toArray($r));
1483                 }
1484
1485                 return $identities;
1486         }
1487
1488         /**
1489          * Returns statistical information about the current users of this node
1490          *
1491          * @return array
1492          *
1493          * @throws Exception
1494          */
1495         public static function getStatistics()
1496         {
1497                 $statistics = [
1498                         'total_users'           => 0,
1499                         'active_users_halfyear' => 0,
1500                         'active_users_monthly'  => 0,
1501                         'active_users_weekly'   => 0,
1502                 ];
1503
1504                 $userStmt = DBA::select('owner-view', ['uid', 'login_date', 'last-item'],
1505                         ["`verified` AND `login_date` > ? AND NOT `blocked`
1506                         AND NOT `account_removed` AND NOT `account_expired`",
1507                         DBA::NULL_DATETIME]);
1508                 if (!DBA::isResult($userStmt)) {
1509                         return $statistics;
1510                 }
1511
1512                 $halfyear = time() - (180 * 24 * 60 * 60);
1513                 $month = time() - (30 * 24 * 60 * 60);
1514                 $week = time() - (7 * 24 * 60 * 60);
1515
1516                 while ($user = DBA::fetch($userStmt)) {
1517                         $statistics['total_users']++;
1518
1519                         if ((strtotime($user['login_date']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1520                         ) {
1521                                 $statistics['active_users_halfyear']++;
1522                         }
1523
1524                         if ((strtotime($user['login_date']) > $month) || (strtotime($user['last-item']) > $month)
1525                         ) {
1526                                 $statistics['active_users_monthly']++;
1527                         }
1528
1529                         if ((strtotime($user['login_date']) > $week) || (strtotime($user['last-item']) > $week)
1530                         ) {
1531                                 $statistics['active_users_weekly']++;
1532                         }
1533                 }
1534                 DBA::close($userStmt);
1535
1536                 return $statistics;
1537         }
1538
1539         /**
1540          * Get all users of the current node
1541          *
1542          * @param int    $start Start count (Default is 0)
1543          * @param int    $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1544          * @param string $type  The type of users, which should get (all, bocked, removed)
1545          * @param string $order Order of the user list (Default is 'contact.name')
1546          * @param bool   $descending Order direction (Default is ascending)
1547          *
1548          * @return array The list of the users
1549          * @throws Exception
1550          */
1551         public static function getList($start = 0, $count = Pager::ITEMS_PER_PAGE, $type = 'all', $order = 'name', bool $descending = false)
1552         {
1553                 $param = ['limit' => [$start, $count], 'order' => [$order => $descending]];
1554                 $condition = [];
1555                 switch ($type) {
1556                         case 'active':
1557                                 $condition['account_removed'] = false;
1558                                 $condition['blocked'] = false;
1559                                 break;
1560                         case 'blocked':
1561                                 $condition['account_removed'] = false;
1562                                 $condition['blocked'] = true;
1563                                 $condition['verified'] = true;
1564                                 break;
1565                         case 'removed':
1566                                 $condition['account_removed'] = true;
1567                                 break;
1568                 }
1569
1570                 return DBA::selectToArray('owner-view', [], $condition, $param);
1571         }
1572 }