src/Model/User.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2023, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Model;
  23
  24 use DivineOmega\DOFileCachePSR6\CacheItemPool;
  25 use DivineOmega\PasswordExposed;
  26 use ErrorException;
  27 use Exception;
  28 use Friendica\Content\Pager;
  29 use Friendica\Core\Hook;
  30 use Friendica\Core\L10n;
  31 use Friendica\Core\Logger;
  32 use Friendica\Core\Protocol;
  33 use Friendica\Core\Search;
  34 use Friendica\Core\System;
  35 use Friendica\Core\Worker;
  36 use Friendica\Database\DBA;
  37 use Friendica\DI;
  38 use Friendica\Network\HTTPClient\Client\HttpClientAccept;
  39 use Friendica\Security\TwoFactor\Model\AppSpecificPassword;
  40 use Friendica\Network\HTTPException;
  41 use Friendica\Object\Image;
  42 use Friendica\Protocol\Delivery;
  43 use Friendica\Util\Crypto;
  44 use Friendica\Util\DateTimeFormat;
  45 use Friendica\Util\Images;
  46 use Friendica\Util\Network;
  47 use Friendica\Util\Proxy;
  48 use Friendica\Util\Strings;
  49 use ImagickException;
  50 use LightOpenID;
  51
  52 /**
  53  * This class handles User related functions
  54  */
  55 class User
  56 {
  57         /**
  58          * Page/profile types
  59          *
  60          * PAGE_FLAGS_NORMAL is a typical personal profile account
  61          * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
  62          * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
  63          *      write access to wall and comments (no email and not included in page owner's ACL lists)
  64          * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
  65          *
  66          * @{
  67          */
  68         const PAGE_FLAGS_NORMAL    = 0;
  69         const PAGE_FLAGS_SOAPBOX   = 1;
  70         const PAGE_FLAGS_COMMUNITY = 2;
  71         const PAGE_FLAGS_FREELOVE  = 3;
  72         const PAGE_FLAGS_BLOG      = 4;
  73         const PAGE_FLAGS_PRVGROUP  = 5;
  74         /**
  75          * @}
  76          */
  77
  78         /**
  79          * Account types
  80          *
  81          * ACCOUNT_TYPE_PERSON - the account belongs to a person
  82          *      Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
  83          *
  84          * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
  85          *      Associated page type: PAGE_FLAGS_SOAPBOX
  86          *
  87          * ACCOUNT_TYPE_NEWS - the account is a news reflector
  88          *      Associated page type: PAGE_FLAGS_SOAPBOX
  89          *
  90          * ACCOUNT_TYPE_COMMUNITY - the account is community forum
  91          *      Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
  92          *
  93          * ACCOUNT_TYPE_RELAY - the account is a relay
  94          *      This will only be assigned to contacts, not to user accounts
  95          * @{
  96          */
  97         const ACCOUNT_TYPE_PERSON =       0;
  98         const ACCOUNT_TYPE_ORGANISATION = 1;
  99         const ACCOUNT_TYPE_NEWS =         2;
 100         const ACCOUNT_TYPE_COMMUNITY =    3;
 101         const ACCOUNT_TYPE_RELAY =        4;
 102         const ACCOUNT_TYPE_DELETED =    127;
 103         /**
 104          * @}
 105          */
 106
 107         private static $owner;
 108
 109         /**
 110          * Returns the numeric account type by their string
 111          *
 112          * @param string $accounttype as string constant
 113          * @return int|null Numeric account type - or null when not set
 114          */
 115         public static function getAccountTypeByString(string $accounttype)
 116         {
 117                 switch ($accounttype) {
 118                         case 'person':
 119                                 return User::ACCOUNT_TYPE_PERSON;
 120
 121                         case 'organisation':
 122                                 return User::ACCOUNT_TYPE_ORGANISATION;
 123
 124                         case 'news':
 125                                 return User::ACCOUNT_TYPE_NEWS;
 126
 127                         case 'community':
 128                                 return User::ACCOUNT_TYPE_COMMUNITY;
 129
 130                 }
 131                 return null;
 132         }
 133
 134         /**
 135          * Fetch the system account
 136          *
 137          * @return array system account
 138          */
 139         public static function getSystemAccount(): array
 140         {
 141                 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 142                 if (!DBA::isResult($system)) {
 143                         self::createSystemAccount();
 144                         $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 145                         if (!DBA::isResult($system)) {
 146                                 return [];
 147                         }
 148                 }
 149
 150                 $system['sprvkey'] = $system['uprvkey'] = $system['prvkey'];
 151                 $system['spubkey'] = $system['upubkey'] = $system['pubkey'];
 152                 $system['nickname'] = $system['nick'];
 153                 $system['page-flags'] = User::PAGE_FLAGS_SOAPBOX;
 154                 $system['account-type'] = $system['contact-type'];
 155                 $system['guid'] = '';
 156                 $system['picdate'] = '';
 157                 $system['theme'] = '';
 158                 $system['publish'] = false;
 159                 $system['net-publish'] = false;
 160                 $system['hide-friends'] = true;
 161                 $system['hidewall'] = true;
 162                 $system['prv_keywords'] = '';
 163                 $system['pub_keywords'] = '';
 164                 $system['address'] = '';
 165                 $system['locality'] = '';
 166                 $system['region'] = '';
 167                 $system['postal-code'] = '';
 168                 $system['country-name'] = '';
 169                 $system['homepage'] = DI::baseUrl()->get();
 170                 $system['dob'] = '0000-00-00';
 171
 172                 // Ensure that the user contains data
 173                 $user = DBA::selectFirst('user', ['prvkey', 'guid'], ['uid' => 0]);
 174                 if (empty($user['prvkey']) || empty($user['guid'])) {
 175                         $fields = [
 176                                 'username' => $system['name'],
 177                                 'nickname' => $system['nick'],
 178                                 'register_date' => $system['created'],
 179                                 'pubkey' => $system['pubkey'],
 180                                 'prvkey' => $system['prvkey'],
 181                                 'spubkey' => $system['spubkey'],
 182                                 'sprvkey' => $system['sprvkey'],
 183                                 'guid' => System::createUUID(),
 184                                 'verified' => true,
 185                                 'page-flags' => User::PAGE_FLAGS_SOAPBOX,
 186                                 'account-type' => User::ACCOUNT_TYPE_RELAY,
 187                         ];
 188
 189                         DBA::update('user', $fields, ['uid' => 0]);
 190
 191                         $system['guid'] = $fields['guid'];
 192                 } else {
 193                         $system['guid'] = $user['guid'];
 194                 }
 195
 196                 return $system;
 197         }
 198
 199         /**
 200          * Create the system account
 201          *
 202          * @return void
 203          */
 204         private static function createSystemAccount()
 205         {
 206                 $system_actor_name = self::getActorName();
 207                 if (empty($system_actor_name)) {
 208                         return;
 209                 }
 210
 211                 $keys = Crypto::newKeypair(4096);
 212                 if ($keys === false) {
 213                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 214                 }
 215
 216                 $system = [
 217                         'uid'          => 0,
 218                         'created'      => DateTimeFormat::utcNow(),
 219                         'self'         => true,
 220                         'network'      => Protocol::ACTIVITYPUB,
 221                         'name'         => 'System Account',
 222                         'addr'         => $system_actor_name . '@' . DI::baseUrl()->getHostname(),
 223                         'nick'         => $system_actor_name,
 224                         'url'          => DI::baseUrl() . '/friendica',
 225                         'pubkey'       => $keys['pubkey'],
 226                         'prvkey'       => $keys['prvkey'],
 227                         'blocked'      => 0,
 228                         'pending'      => 0,
 229                         'contact-type' => Contact::TYPE_RELAY, // In AP this is translated to 'Application'
 230                         'name-date'    => DateTimeFormat::utcNow(),
 231                         'uri-date'     => DateTimeFormat::utcNow(),
 232                         'avatar-date'  => DateTimeFormat::utcNow(),
 233                         'closeness'    => 0,
 234                         'baseurl'      => DI::baseUrl(),
 235                 ];
 236
 237                 $system['avatar'] = $system['photo'] = Contact::getDefaultAvatar($system, Proxy::SIZE_SMALL);
 238                 $system['thumb']  = Contact::getDefaultAvatar($system, Proxy::SIZE_THUMB);
 239                 $system['micro']  = Contact::getDefaultAvatar($system, Proxy::SIZE_MICRO);
 240                 $system['nurl']   = Strings::normaliseLink($system['url']);
 241                 $system['gsid']   = GServer::getID($system['baseurl']);
 242
 243                 Contact::insert($system);
 244         }
 245
 246         /**
 247          * Detect a usable actor name
 248          *
 249          * @return string actor account name
 250          */
 251         public static function getActorName(): string
 252         {
 253                 $system_actor_name = DI::config()->get('system', 'actor_name');
 254                 if (!empty($system_actor_name)) {
 255                         $self = Contact::selectFirst(['nick'], ['uid' => 0, 'self' => true]);
 256                         if (!empty($self['nick'])) {
 257                                 if ($self['nick'] != $system_actor_name) {
 258                                         // Reset the actor name to the already used name
 259                                         DI::config()->set('system', 'actor_name', $self['nick']);
 260                                         $system_actor_name = $self['nick'];
 261                                 }
 262                         }
 263                         return $system_actor_name;
 264                 }
 265
 266                 // List of possible actor names
 267                 $possible_accounts = ['friendica', 'actor', 'system', 'internal'];
 268                 foreach ($possible_accounts as $name) {
 269                         if (!DBA::exists('user', ['nickname' => $name, 'account_removed' => false, 'account_expired' => false]) &&
 270                                 !DBA::exists('userd', ['username' => $name])) {
 271                                 DI::config()->set('system', 'actor_name', $name);
 272                                 return $name;
 273                         }
 274                 }
 275                 return '';
 276         }
 277
 278         /**
 279          * Returns true if a user record exists with the provided id
 280          *
 281          * @param  int $uid
 282          *
 283          * @return boolean
 284          * @throws Exception
 285          */
 286         public static function exists(int $uid): bool
 287         {
 288                 return DBA::exists('user', ['uid' => $uid]);
 289         }
 290
 291         /**
 292          * @param  integer       $uid
 293          * @param array          $fields
 294          * @return array|boolean User record if it exists, false otherwise
 295          * @throws Exception
 296          */
 297         public static function getById(int $uid, array $fields = [])
 298         {
 299                 return !empty($uid) ? DBA::selectFirst('user', $fields, ['uid' => $uid]) : [];
 300         }
 301
 302         /**
 303          * Returns a user record based on it's GUID
 304          *
 305          * @param string $guid   The guid of the user
 306          * @param array  $fields The fields to retrieve
 307          * @param bool   $active True, if only active records are searched
 308          *
 309          * @return array|boolean User record if it exists, false otherwise
 310          * @throws Exception
 311          */
 312         public static function getByGuid(string $guid, array $fields = [], bool $active = true)
 313         {
 314                 if ($active) {
 315                         $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
 316                 } else {
 317                         $cond = ['guid' => $guid];
 318                 }
 319
 320                 return DBA::selectFirst('user', $fields, $cond);
 321         }
 322
 323         /**
 324          * @param  string        $nickname
 325          * @param array          $fields
 326          * @return array|boolean User record if it exists, false otherwise
 327          * @throws Exception
 328          */
 329         public static function getByNickname(string $nickname, array $fields = [])
 330         {
 331                 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
 332         }
 333
 334         /**
 335          * Returns the user id of a given profile URL
 336          *
 337          * @param string $url
 338          *
 339          * @return integer user id
 340          * @throws Exception
 341          */
 342         public static function getIdForURL(string $url): int
 343         {
 344                 // Avoid database queries when the local node hostname isn't even part of the url.
 345                 if (!Contact::isLocal($url)) {
 346                         return 0;
 347                 }
 348
 349                 $self = Contact::selectFirst(['uid'], ['self' => true, 'nurl' => Strings::normaliseLink($url)]);
 350                 if (!empty($self['uid'])) {
 351                         return $self['uid'];
 352                 }
 353
 354                 $self = Contact::selectFirst(['uid'], ['self' => true, 'addr' => $url]);
 355                 if (!empty($self['uid'])) {
 356                         return $self['uid'];
 357                 }
 358
 359                 $self = Contact::selectFirst(['uid'], ['self' => true, 'alias' => [$url, Strings::normaliseLink($url)]]);
 360                 if (!empty($self['uid'])) {
 361                         return $self['uid'];
 362                 }
 363
 364                 return 0;
 365         }
 366
 367         /**
 368          * Get a user based on its email
 369          *
 370          * @param string $email
 371          * @param array  $fields
 372          * @return array|boolean User record if it exists, false otherwise
 373          * @throws Exception
 374          */
 375         public static function getByEmail(string $email, array $fields = [])
 376         {
 377                 return DBA::selectFirst('user', $fields, ['email' => $email]);
 378         }
 379
 380         /**
 381          * Fetch the user array of the administrator. The first one if there are several.
 382          *
 383          * @param array $fields
 384          * @return array user
 385          * @throws Exception
 386          */
 387         public static function getFirstAdmin(array $fields = []) : array
 388         {
 389                 if (!empty(DI::config()->get('config', 'admin_nickname'))) {
 390                         return self::getByNickname(DI::config()->get('config', 'admin_nickname'), $fields);
 391                 }
 392
 393                 return self::getAdminList()[0] ?? [];
 394         }
 395
 396         /**
 397          * Get owner data by user id
 398          *
 399          * @param int     $uid
 400          * @param boolean $repairMissing Repair the owner data if it's missing
 401          * @return boolean|array
 402          * @throws Exception
 403          */
 404         public static function getOwnerDataById(int $uid, bool $repairMissing = true)
 405         {
 406                 if ($uid == 0) {
 407                         return self::getSystemAccount();
 408                 }
 409
 410                 if (!empty(self::$owner[$uid])) {
 411                         return self::$owner[$uid];
 412                 }
 413
 414                 $owner = DBA::selectFirst('owner-view', [], ['uid' => $uid]);
 415                 if (!DBA::isResult($owner)) {
 416                         if (!self::exists($uid) || !$repairMissing) {
 417                                 return false;
 418                         }
 419                         if (!DBA::exists('profile', ['uid' => $uid])) {
 420                                 DBA::insert('profile', ['uid' => $uid]);
 421                         }
 422                         if (!DBA::exists('contact', ['uid' => $uid, 'self' => true])) {
 423                                 Contact::createSelfFromUserId($uid);
 424                         }
 425                         $owner = self::getOwnerDataById($uid, false);
 426                 }
 427
 428                 if (empty($owner['nickname'])) {
 429                         return false;
 430                 }
 431
 432                 if (!$repairMissing || $owner['account_expired']) {
 433                         return $owner;
 434                 }
 435
 436                 // Check if the returned data is valid, otherwise fix it. See issue #6122
 437
 438                 // Check for correct url and normalised nurl
 439                 $url = DI::baseUrl() . '/profile/' . $owner['nickname'];
 440                 $repair = empty($owner['network']) || ($owner['url'] != $url) || ($owner['nurl'] != Strings::normaliseLink($owner['url']));
 441
 442                 if (!$repair) {
 443                         // Check if "addr" is present and correct
 444                         $addr = $owner['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
 445                         $repair = ($addr != $owner['addr']) || empty($owner['prvkey']) || empty($owner['pubkey']);
 446                 }
 447
 448                 if (!$repair) {
 449                         // Check if the avatar field is filled and the photo directs to the correct path
 450                         $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
 451                         if (DBA::isResult($avatar)) {
 452                                 $repair = empty($owner['avatar']) || !strpos($owner['photo'], $avatar['resource-id']);
 453                         }
 454                 }
 455
 456                 if ($repair) {
 457                         Contact::updateSelfFromUserID($uid);
 458                         // Return the corrected data and avoid a loop
 459                         $owner = self::getOwnerDataById($uid, false);
 460                 }
 461
 462                 self::$owner[$uid] = $owner;
 463                 return $owner;
 464         }
 465
 466         /**
 467          * Get owner data by nick name
 468          *
 469          * @param int $nick
 470          * @return boolean|array
 471          * @throws Exception
 472          */
 473         public static function getOwnerDataByNick(string $nick)
 474         {
 475                 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
 476
 477                 if (!DBA::isResult($user)) {
 478                         return false;
 479                 }
 480
 481                 return self::getOwnerDataById($user['uid']);
 482         }
 483
 484         /**
 485          * Returns the default group for a given user and network
 486          *
 487          * @param int $uid User id
 488          *
 489          * @return int group id
 490          * @throws Exception
 491          */
 492         public static function getDefaultGroup(int $uid): int
 493         {
 494                 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
 495                 if (DBA::isResult($user)) {
 496                         $default_group = $user["def_gid"];
 497                 } else {
 498                         $default_group = 0;
 499                 }
 500
 501                 return $default_group;
 502         }
 503
 504         /**
 505          * Authenticate a user with a clear text password
 506          *
 507          * Returns the user id associated with a successful password authentication
 508          *
 509          * @param mixed  $user_info
 510          * @param string $password
 511          * @param bool   $third_party
 512          * @return int User Id if authentication is successful
 513          * @throws HTTPException\ForbiddenException
 514          * @throws HTTPException\NotFoundException
 515          */
 516         public static function getIdFromPasswordAuthentication($user_info, string $password, bool $third_party = false): int
 517         {
 518                 // Addons registered with the "authenticate" hook may create the user on the
 519                 // fly. `getAuthenticationInfo` will fail if the user doesn't exist yet. If
 520                 // the user doesn't exist, we should give the addons a chance to create the
 521                 // user in our database, if applicable, before re-throwing the exception if
 522                 // they fail.
 523                 try {
 524                         $user = self::getAuthenticationInfo($user_info);
 525                 } catch (Exception $e) {
 526                         $username = (is_string($user_info) ? $user_info : $user_info['nickname'] ?? '');
 527
 528                         // Addons can create users, and since this 'catch' branch should only
 529                         // execute if getAuthenticationInfo can't find an existing user, that's
 530                         // exactly what will happen here. Creating a numeric username would create
 531                         // abiguity with user IDs, possibly opening up an attack vector.
 532                         // So let's be very careful about that.
 533                         if (empty($username) || is_numeric($username)) {
 534                                 throw $e;
 535                         }
 536
 537                         return self::getIdFromAuthenticateHooks($username, $password);
 538                 }
 539
 540                 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
 541                         // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
 542                         if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
 543                                 return $user['uid'];
 544                         }
 545                 } elseif (strpos($user['password'], '$') === false) {
 546                         //Legacy hash that has not been replaced by a new hash yet
 547                         if (self::hashPasswordLegacy($password) === $user['password']) {
 548                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 549
 550                                 return $user['uid'];
 551                         }
 552                 } elseif (!empty($user['legacy_password'])) {
 553                         //Legacy hash that has been double-hashed and not replaced by a new hash yet
 554                         //Warning: `legacy_password` is not necessary in sync with the content of `password`
 555                         if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
 556                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 557
 558                                 return $user['uid'];
 559                         }
 560                 } elseif (password_verify($password, $user['password'])) {
 561                         //New password hash
 562                         if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
 563                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 564                         }
 565
 566                         return $user['uid'];
 567                 } else {
 568                         return self::getIdFromAuthenticateHooks($user['nickname'], $password); // throws
 569                 }
 570
 571                 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
 572         }
 573
 574         /**
 575          * Try to obtain a user ID via "authenticate" hook addons
 576          *
 577          * Returns the user id associated with a successful password authentication
 578          *
 579          * @param string $username
 580          * @param string $password
 581          * @return int User Id if authentication is successful
 582          * @throws HTTPException\ForbiddenException
 583          */
 584         public static function getIdFromAuthenticateHooks(string $username, string $password): int
 585         {
 586                 $addon_auth = [
 587                         'username'      => $username,
 588                         'password'      => $password,
 589                         'authenticated' => 0,
 590                         'user_record'   => null
 591                 ];
 592
 593                 /*
 594                  * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
 595                  * Addons should never set 'authenticated' except to indicate success - as hooks may be chained
 596                  * and later addons should not interfere with an earlier one that succeeded.
 597                  */
 598                 Hook::callAll('authenticate', $addon_auth);
 599
 600                 if ($addon_auth['authenticated'] && $addon_auth['user_record']) {
 601                         return $addon_auth['user_record']['uid'];
 602                 }
 603
 604                 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
 605         }
 606
 607         /**
 608          * Returns authentication info from various parameters types
 609          *
 610          * User info can be any of the following:
 611          * - User DB object
 612          * - User Id
 613          * - User email or username or nickname
 614          * - User array with at least the uid and the hashed password
 615          *
 616          * @param mixed $user_info
 617          * @return array|null Null if not found/determined
 618          * @throws HTTPException\NotFoundException
 619          */
 620         public static function getAuthenticationInfo($user_info)
 621         {
 622                 $user = null;
 623
 624                 if (is_object($user_info) || is_array($user_info)) {
 625                         if (is_object($user_info)) {
 626                                 $user = (array) $user_info;
 627                         } else {
 628                                 $user = $user_info;
 629                         }
 630
 631                         if (
 632                                 !isset($user['uid'])
 633                                 || !isset($user['password'])
 634                                 || !isset($user['legacy_password'])
 635                         ) {
 636                                 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
 637                         }
 638                 } elseif (is_int($user_info) || is_string($user_info)) {
 639                         if (is_int($user_info)) {
 640                                 $user = DBA::selectFirst(
 641                                         'user',
 642                                         ['uid', 'nickname', 'password', 'legacy_password'],
 643                                         [
 644                                                 'uid' => $user_info,
 645                                                 'blocked' => 0,
 646                                                 'account_expired' => 0,
 647                                                 'account_removed' => 0,
 648                                                 'verified' => 1
 649                                         ]
 650                                 );
 651                         } else {
 652                                 $fields = ['uid', 'nickname', 'password', 'legacy_password'];
 653                                 $condition = [
 654                                         "(`email` = ? OR `username` = ? OR `nickname` = ?)
 655                                         AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
 656                                         $user_info, $user_info, $user_info
 657                                 ];
 658                                 $user = DBA::selectFirst('user', $fields, $condition);
 659                         }
 660
 661                         if (!DBA::isResult($user)) {
 662                                 throw new HTTPException\NotFoundException(DI::l10n()->t('User not found'));
 663                         }
 664                 }
 665
 666                 return $user;
 667         }
 668
 669         /**
 670          * Update the day of the last activity of the given user
 671          *
 672          * @param integer $uid
 673          * @return void
 674          */
 675         public static function updateLastActivity(int $uid)
 676         {
 677                 $user = User::getById($uid, ['last-activity']);
 678                 if (empty($user)) {
 679                         return;
 680                 }
 681
 682                 $current_day = DateTimeFormat::utcNow('Y-m-d');
 683
 684                 if ($user['last-activity'] != $current_day) {
 685                         User::update(['last-activity' => $current_day], $uid);
 686                         // Set the last actitivy for all identities of the user
 687                         DBA::update('user', ['last-activity' => $current_day], ['parent-uid' => $uid, 'account_removed' => false]);
 688                 }
 689         }
 690
 691         /**
 692          * Generates a human-readable random password
 693          *
 694          * @return string
 695          * @throws Exception
 696          */
 697         public static function generateNewPassword(): string
 698         {
 699                 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
 700         }
 701
 702         /**
 703          * Checks if the provided plaintext password has been exposed or not
 704          *
 705          * @param string $password
 706          * @return bool
 707          * @throws Exception
 708          */
 709         public static function isPasswordExposed(string $password): bool
 710         {
 711                 $cache = new CacheItemPool();
 712                 $cache->changeConfig([
 713                         'cacheDirectory' => System::getTempPath() . '/password-exposed-cache/',
 714                 ]);
 715
 716                 try {
 717                         $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
 718
 719                         return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
 720                 } catch (Exception $e) {
 721                         Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
 722                                 'code' => $e->getCode(),
 723                                 'file' => $e->getFile(),
 724                                 'line' => $e->getLine(),
 725                                 'trace' => $e->getTraceAsString()
 726                         ]);
 727
 728                         return false;
 729                 }
 730         }
 731
 732         /**
 733          * Legacy hashing function, kept for password migration purposes
 734          *
 735          * @param string $password
 736          * @return string
 737          */
 738         private static function hashPasswordLegacy(string $password): string
 739         {
 740                 return hash('whirlpool', $password);
 741         }
 742
 743         /**
 744          * Global user password hashing function
 745          *
 746          * @param string $password
 747          * @return string
 748          * @throws Exception
 749          */
 750         public static function hashPassword(string $password): string
 751         {
 752                 if (!trim($password)) {
 753                         throw new Exception(DI::l10n()->t('Password can\'t be empty'));
 754                 }
 755
 756                 return password_hash($password, PASSWORD_DEFAULT);
 757         }
 758
 759         /**
 760          * Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).
 761          *
 762          * Password length is limited to 72 characters if the current default password hashing algorithm is Blowfish.
 763          * From the manual: "Using the PASSWORD_BCRYPT as the algorithm, will result in the password parameter being
 764          * truncated to a maximum length of 72 bytes."
 765          *
 766          * @see https://www.php.net/manual/en/function.password-hash.php#refsect1-function.password-hash-parameters
 767          *
 768          * @param string|null $delimiter Whether the regular expression is meant to be wrapper in delimiter characters
 769          * @return string
 770          */
 771         public static function getPasswordRegExp(string $delimiter = null): string
 772         {
 773                 $allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
 774
 775                 if ($delimiter) {
 776                         $allowed_characters = preg_quote($allowed_characters, $delimiter);
 777                 }
 778
 779                 return '^[a-zA-Z0-9' . $allowed_characters . ']' . (PASSWORD_DEFAULT !== PASSWORD_BCRYPT ? '{1,72}' : '+') . '$';
 780         }
 781
 782         /**
 783          * Updates a user row with a new plaintext password
 784          *
 785          * @param int    $uid
 786          * @param string $password
 787          * @return bool
 788          * @throws Exception
 789          */
 790         public static function updatePassword(int $uid, string $password): bool
 791         {
 792                 $password = trim($password);
 793
 794                 if (empty($password)) {
 795                         throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
 796                 }
 797
 798                 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
 799                         throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
 800                 }
 801
 802                 if (PASSWORD_DEFAULT === PASSWORD_BCRYPT && strlen($password) > 72) {
 803                         throw new Exception(DI::l10n()->t('The password length is limited to 72 characters.'));
 804                 }
 805
 806                 if (!preg_match('/' . self::getPasswordRegExp('/') . '/', $password)) {
 807                         throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
 808                 }
 809
 810                 return self::updatePasswordHashed($uid, self::hashPassword($password));
 811         }
 812
 813         /**
 814          * Updates a user row with a new hashed password.
 815          * Empties the password reset token field just in case.
 816          *
 817          * @param int    $uid
 818          * @param string $pasword_hashed
 819          * @return bool
 820          * @throws Exception
 821          */
 822         private static function updatePasswordHashed(int $uid, string $pasword_hashed): bool
 823         {
 824                 $fields = [
 825                         'password' => $pasword_hashed,
 826                         'pwdreset' => null,
 827                         'pwdreset_time' => null,
 828                         'legacy_password' => false
 829                 ];
 830                 return DBA::update('user', $fields, ['uid' => $uid]);
 831         }
 832
 833         /**
 834          * Returns if the given uid is valid and in the admin list
 835          *
 836          * @param int $uid
 837          *
 838          * @return bool
 839          * @throws Exception
 840          */
 841         public static function isSiteAdmin(int $uid): bool
 842         {
 843                 return DBA::exists('user', [
 844                         'uid'   => $uid,
 845                         'email' => self::getAdminEmailList()
 846                 ]);
 847         }
 848
 849         /**
 850          * Checks if a nickname is in the list of the forbidden nicknames
 851          *
 852          * Check if a nickname is forbidden from registration on the node by the
 853          * admin. Forbidden nicknames (e.g. role namess) can be configured in the
 854          * admin panel.
 855          *
 856          * @param string $nickname The nickname that should be checked
 857          * @return boolean True is the nickname is blocked on the node
 858          */
 859         public static function isNicknameBlocked(string $nickname): bool
 860         {
 861                 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
 862                 if (!empty($forbidden_nicknames)) {
 863                         $forbidden = explode(',', $forbidden_nicknames);
 864                         $forbidden = array_map('trim', $forbidden);
 865                 } else {
 866                         $forbidden = [];
 867                 }
 868
 869                 // Add the name of the internal actor to the "forbidden" list
 870                 $actor_name = self::getActorName();
 871                 if (!empty($actor_name)) {
 872                         $forbidden[] = $actor_name;
 873                 }
 874
 875                 if (empty($forbidden)) {
 876                         return false;
 877                 }
 878
 879                 // check if the nickname is in the list of blocked nicknames
 880                 if (in_array(strtolower($nickname), $forbidden)) {
 881                         return true;
 882                 }
 883
 884                 // else return false
 885                 return false;
 886         }
 887
 888         /**
 889          * Get avatar link for given user
 890          *
 891          * @param array  $user
 892          * @param string $size One of the Proxy::SIZE_* constants
 893          * @return string avatar link
 894          * @throws Exception
 895          */
 896         public static function getAvatarUrl(array $user, string $size = ''): string
 897         {
 898                 if (empty($user['nickname'])) {
 899                         DI::logger()->warning('Missing user nickname key', ['trace' => System::callstack(20)]);
 900                 }
 901
 902                 $url = DI::baseUrl() . '/photo/';
 903
 904                 switch ($size) {
 905                         case Proxy::SIZE_MICRO:
 906                                 $url .= 'micro/';
 907                                 $scale = 6;
 908                                 break;
 909                         case Proxy::SIZE_THUMB:
 910                                 $url .= 'avatar/';
 911                                 $scale = 5;
 912                                 break;
 913                         default:
 914                                 $url .= 'profile/';
 915                                 $scale = 4;
 916                                 break;
 917                 }
 918
 919                 $updated  =  '';
 920                 $mimetype = '';
 921
 922                 $photo = Photo::selectFirst(['type', 'created', 'edited', 'updated'], ["scale" => $scale, 'uid' => $user['uid'], 'profile' => true]);
 923                 if (!empty($photo)) {
 924                         $updated  = max($photo['created'], $photo['edited'], $photo['updated']);
 925                         $mimetype = $photo['type'];
 926                 }
 927
 928                 return $url . $user['nickname'] . Images::getExtensionByMimeType($mimetype) . ($updated ? '?ts=' . strtotime($updated) : '');
 929         }
 930
 931         /**
 932          * Get banner link for given user
 933          *
 934          * @param array  $user
 935          * @return string banner link
 936          * @throws Exception
 937          */
 938         public static function getBannerUrl(array $user): string
 939         {
 940                 if (empty($user['nickname'])) {
 941                         DI::logger()->warning('Missing user nickname key', ['trace' => System::callstack(20)]);
 942                 }
 943
 944                 $url = DI::baseUrl() . '/photo/banner/';
 945
 946                 $updated  = '';
 947                 $mimetype = '';
 948
 949                 $photo = Photo::selectFirst(['type', 'created', 'edited', 'updated'], ["scale" => 3, 'uid' => $user['uid'], 'photo-type' => Photo::USER_BANNER]);
 950                 if (!empty($photo)) {
 951                         $updated  = max($photo['created'], $photo['edited'], $photo['updated']);
 952                         $mimetype = $photo['type'];
 953                 } else {
 954                         // Only for the RC phase: Don't return an image link for the default picture
 955                         return '';
 956                 }
 957
 958                 return $url . $user['nickname'] . Images::getExtensionByMimeType($mimetype) . ($updated ? '?ts=' . strtotime($updated) : '');
 959         }
 960
 961         /**
 962          * Catch-all user creation function
 963          *
 964          * Creates a user from the provided data array, either form fields or OpenID.
 965          * Required: { username, nickname, email } or { openid_url }
 966          *
 967          * Performs the following:
 968          * - Sends to the OpenId auth URL (if relevant)
 969          * - Creates new key pairs for crypto
 970          * - Create self-contact
 971          * - Create profile image
 972          *
 973          * @param  array $data
 974          * @return array
 975          * @throws ErrorException
 976          * @throws HTTPException\InternalServerErrorException
 977          * @throws ImagickException
 978          * @throws Exception
 979          */
 980         public static function create(array $data): array
 981         {
 982                 $return = ['user' => null, 'password' => ''];
 983
 984                 $using_invites = DI::config()->get('system', 'invitation_only');
 985
 986                 $invite_id  = !empty($data['invite_id'])  ? trim($data['invite_id'])  : '';
 987                 $username   = !empty($data['username'])   ? trim($data['username'])   : '';
 988                 $nickname   = !empty($data['nickname'])   ? trim($data['nickname'])   : '';
 989                 $email      = !empty($data['email'])      ? trim($data['email'])      : '';
 990                 $openid_url = !empty($data['openid_url']) ? trim($data['openid_url']) : '';
 991                 $photo      = !empty($data['photo'])      ? trim($data['photo'])      : '';
 992                 $password   = !empty($data['password'])   ? trim($data['password'])   : '';
 993                 $password1  = !empty($data['password1'])  ? trim($data['password1'])  : '';
 994                 $confirm    = !empty($data['confirm'])    ? trim($data['confirm'])    : '';
 995                 $blocked    = !empty($data['blocked']);
 996                 $verified   = !empty($data['verified']);
 997                 $language   = !empty($data['language'])   ? trim($data['language'])   : 'en';
 998
 999                 $netpublish = $publish = !empty($data['profile_publish_reg']);
1000
1001                 if ($password1 != $confirm) {
1002                         throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
1003                 } elseif ($password1 != '') {
1004                         $password = $password1;
1005                 }
1006
1007                 if ($using_invites) {
1008                         if (!$invite_id) {
1009                                 throw new Exception(DI::l10n()->t('An invitation is required.'));
1010                         }
1011
1012                         if (!Register::existsByHash($invite_id)) {
1013                                 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
1014                         }
1015                 }
1016
1017                 /// @todo Check if this part is really needed. We should have fetched all this data in advance
1018                 if (empty($username) || empty($email) || empty($nickname)) {
1019                         if ($openid_url) {
1020                                 if (!Network::isUrlValid($openid_url)) {
1021                                         throw new Exception(DI::l10n()->t('Invalid OpenID url'));
1022                                 }
1023                                 $_SESSION['register'] = 1;
1024                                 $_SESSION['openid'] = $openid_url;
1025
1026                                 $openid = new LightOpenID(DI::baseUrl()->getHostname());
1027                                 $openid->identity = $openid_url;
1028                                 $openid->returnUrl = DI::baseUrl() . '/openid';
1029                                 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
1030                                 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
1031                                 try {
1032                                         $authurl = $openid->authUrl();
1033                                 } catch (Exception $e) {
1034                                         throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . '<br />' . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
1035                                 }
1036                                 System::externalRedirect($authurl);
1037                                 // NOTREACHED
1038                         }
1039
1040                         throw new Exception(DI::l10n()->t('Please enter the required information.'));
1041                 }
1042
1043                 if (!Network::isUrlValid($openid_url)) {
1044                         $openid_url = '';
1045                 }
1046
1047                 // collapse multiple spaces in name
1048                 $username = preg_replace('/ +/', ' ', $username);
1049
1050                 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
1051                 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
1052
1053                 if ($username_min_length > $username_max_length) {
1054                         Logger::error(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length));
1055                         $tmp = $username_min_length;
1056                         $username_min_length = $username_max_length;
1057                         $username_max_length = $tmp;
1058                 }
1059
1060                 if (mb_strlen($username) < $username_min_length) {
1061                         throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
1062                 }
1063
1064                 if (mb_strlen($username) > $username_max_length) {
1065                         throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
1066                 }
1067
1068                 // So now we are just looking for a space in the full name.
1069                 $loose_reg = DI::config()->get('system', 'no_regfullname');
1070                 if (!$loose_reg) {
1071                         $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
1072                         if (strpos($username, ' ') === false) {
1073                                 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
1074                         }
1075                 }
1076
1077                 if (!Network::isEmailDomainAllowed($email)) {
1078                         throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
1079                 }
1080
1081                 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
1082                         throw new Exception(DI::l10n()->t('Not a valid email address.'));
1083                 }
1084                 if (self::isNicknameBlocked($nickname)) {
1085                         throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
1086                 }
1087
1088                 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
1089                         throw new Exception(DI::l10n()->t('Cannot use that email.'));
1090                 }
1091
1092                 // Disallow somebody creating an account using openid that uses the admin email address,
1093                 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
1094                 if (strlen($openid_url) && in_array(strtolower($email), self::getAdminEmailList())) {
1095                         throw new Exception(DI::l10n()->t('Cannot use that email.'));
1096                 }
1097
1098                 $nickname = $data['nickname'] = strtolower($nickname);
1099
1100                 if (!preg_match('/^[a-z0-9][a-z0-9_]*$/', $nickname)) {
1101                         throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
1102                 }
1103
1104                 // Check existing and deleted accounts for this nickname.
1105                 if (
1106                         DBA::exists('user', ['nickname' => $nickname])
1107                         || DBA::exists('userd', ['username' => $nickname])
1108                 ) {
1109                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
1110                 }
1111
1112                 $new_password = strlen($password) ? $password : User::generateNewPassword();
1113                 $new_password_encoded = self::hashPassword($new_password);
1114
1115                 $return['password'] = $new_password;
1116
1117                 $keys = Crypto::newKeypair(4096);
1118                 if ($keys === false) {
1119                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
1120                 }
1121
1122                 $prvkey = $keys['prvkey'];
1123                 $pubkey = $keys['pubkey'];
1124
1125                 // Create another keypair for signing/verifying salmon protocol messages.
1126                 $sres = Crypto::newKeypair(512);
1127                 $sprvkey = $sres['prvkey'];
1128                 $spubkey = $sres['pubkey'];
1129
1130                 $insert_result = DBA::insert('user', [
1131                         'guid'     => System::createUUID(),
1132                         'username' => $username,
1133                         'password' => $new_password_encoded,
1134                         'email'    => $email,
1135                         'openid'   => $openid_url,
1136                         'nickname' => $nickname,
1137                         'pubkey'   => $pubkey,
1138                         'prvkey'   => $prvkey,
1139                         'spubkey'  => $spubkey,
1140                         'sprvkey'  => $sprvkey,
1141                         'verified' => $verified,
1142                         'blocked'  => $blocked,
1143                         'language' => $language,
1144                         'timezone' => 'UTC',
1145                         'register_date' => DateTimeFormat::utcNow(),
1146                         'default-location' => ''
1147                 ]);
1148
1149                 if ($insert_result) {
1150                         $uid = DBA::lastInsertId();
1151                         $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1152                 } else {
1153                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1154                 }
1155
1156                 if (!$uid) {
1157                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1158                 }
1159
1160                 // if somebody clicked submit twice very quickly, they could end up with two accounts
1161                 // due to race condition. Remove this one.
1162                 $user_count = DBA::count('user', ['nickname' => $nickname]);
1163                 if ($user_count > 1) {
1164                         DBA::delete('user', ['uid' => $uid]);
1165
1166                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
1167                 }
1168
1169                 $insert_result = DBA::insert('profile', [
1170                         'uid' => $uid,
1171                         'name' => $username,
1172                         'photo' => self::getAvatarUrl($user),
1173                         'thumb' => self::getAvatarUrl($user, Proxy::SIZE_THUMB),
1174                         'publish' => $publish,
1175                         'net-publish' => $netpublish,
1176                 ]);
1177                 if (!$insert_result) {
1178                         DBA::delete('user', ['uid' => $uid]);
1179
1180                         throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
1181                 }
1182
1183                 // Create the self contact
1184                 if (!Contact::createSelfFromUserId($uid)) {
1185                         DBA::delete('user', ['uid' => $uid]);
1186
1187                         throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
1188                 }
1189
1190                 // Create a group with no members. This allows somebody to use it
1191                 // right away as a default group for new contacts.
1192                 $def_gid = Group::create($uid, DI::l10n()->t('Friends'));
1193                 if (!$def_gid) {
1194                         DBA::delete('user', ['uid' => $uid]);
1195
1196                         throw new Exception(DI::l10n()->t('An error occurred creating your default contact group. Please try again.'));
1197                 }
1198
1199                 $fields = ['def_gid' => $def_gid];
1200                 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
1201                         $fields['allow_gid'] = '<' . $def_gid . '>';
1202                 }
1203
1204                 DBA::update('user', $fields, ['uid' => $uid]);
1205
1206                 // if we have no OpenID photo try to look up an avatar
1207                 if (!strlen($photo)) {
1208                         $photo = Network::lookupAvatarByEmail($email);
1209                 }
1210
1211                 // unless there is no avatar-addon loaded
1212                 if (strlen($photo)) {
1213                         $photo_failure = false;
1214
1215                         $filename = basename($photo);
1216                         $curlResult = DI::httpClient()->get($photo, HttpClientAccept::IMAGE);
1217                         if ($curlResult->isSuccess()) {
1218                                 Logger::debug('Got picture', ['Content-Type' => $curlResult->getHeader('Content-Type'), 'url' => $photo]);
1219                                 $img_str = $curlResult->getBody();
1220                                 $type = $curlResult->getContentType();
1221                         } else {
1222                                 $img_str = '';
1223                                 $type = '';
1224                         }
1225
1226                         $type = Images::getMimeTypeByData($img_str, $photo, $type);
1227
1228                         $image = new Image($img_str, $type);
1229                         if ($image->isValid()) {
1230                                 $image->scaleToSquare(300);
1231
1232                                 $resource_id = Photo::newResource();
1233
1234                                 // Not using Photo::PROFILE_PHOTOS here, so that it is discovered as translateble string
1235                                 $profile_album = DI::l10n()->t('Profile Photos');
1236
1237                                 $r = Photo::store($image, $uid, 0, $resource_id, $filename, $profile_album, 4);
1238
1239                                 if ($r === false) {
1240                                         $photo_failure = true;
1241                                 }
1242
1243                                 $image->scaleDown(80);
1244
1245                                 $r = Photo::store($image, $uid, 0, $resource_id, $filename, $profile_album, 5);
1246
1247                                 if ($r === false) {
1248                                         $photo_failure = true;
1249                                 }
1250
1251                                 $image->scaleDown(48);
1252
1253                                 $r = Photo::store($image, $uid, 0, $resource_id, $filename, $profile_album, 6);
1254
1255                                 if ($r === false) {
1256                                         $photo_failure = true;
1257                                 }
1258
1259                                 if (!$photo_failure) {
1260                                         Photo::update(['profile' => true, 'photo-type' => Photo::USER_AVATAR], ['resource-id' => $resource_id]);
1261                                 }
1262                         }
1263
1264                         Contact::updateSelfFromUserID($uid, true);
1265                 }
1266
1267                 Hook::callAll('register_account', $uid);
1268
1269                 $return['user'] = $user;
1270                 return $return;
1271         }
1272
1273         /**
1274          * Update a user entry and distribute the changes if needed
1275          *
1276          * @param array $fields
1277          * @param integer $uid
1278          * @return boolean
1279          */
1280         public static function update(array $fields, int $uid): bool
1281         {
1282                 $old_owner = self::getOwnerDataById($uid);
1283                 if (empty($old_owner)) {
1284                         return false;
1285                 }
1286
1287                 if (!DBA::update('user', $fields, ['uid' => $uid])) {
1288                         return false;
1289                 }
1290
1291                 $update = Contact::updateSelfFromUserID($uid);
1292
1293                 $owner = self::getOwnerDataById($uid);
1294                 if (empty($owner)) {
1295                         return false;
1296                 }
1297
1298                 if ($old_owner['name'] != $owner['name']) {
1299                         Profile::update(['name' => $owner['name']], $uid);
1300                 }
1301
1302                 if ($update) {
1303                         Profile::publishUpdate($uid);
1304                 }
1305
1306                 return true;
1307         }
1308
1309         /**
1310          * Sets block state for a given user
1311          *
1312          * @param int  $uid   The user id
1313          * @param bool $block Block state (default is true)
1314          *
1315          * @return bool True, if successfully blocked
1316
1317          * @throws Exception
1318          */
1319         public static function block(int $uid, bool $block = true): bool
1320         {
1321                 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
1322         }
1323
1324         /**
1325          * Allows a registration based on a hash
1326          *
1327          * @param string $hash
1328          *
1329          * @return bool True, if the allow was successful
1330          *
1331          * @throws HTTPException\InternalServerErrorException
1332          * @throws Exception
1333          */
1334         public static function allow(string $hash): bool
1335         {
1336                 $register = Register::getByHash($hash);
1337                 if (!DBA::isResult($register)) {
1338                         return false;
1339                 }
1340
1341                 $user = User::getById($register['uid']);
1342                 if (!DBA::isResult($user)) {
1343                         return false;
1344                 }
1345
1346                 Register::deleteByHash($hash);
1347
1348                 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
1349
1350                 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
1351
1352                 if (DBA::isResult($profile) && $profile['net-publish'] && Search::getGlobalDirectory()) {
1353                         $url = DI::baseUrl() . '/profile/' . $user['nickname'];
1354                         Worker::add(Worker::PRIORITY_LOW, "Directory", $url);
1355                 }
1356
1357                 $l10n = DI::l10n()->withLang($register['language']);
1358
1359                 return User::sendRegisterOpenEmail(
1360                         $l10n,
1361                         $user,
1362                         DI::config()->get('config', 'sitename'),
1363                         DI::baseUrl()->get(),
1364                         ($register['password'] ?? '') ?: 'Sent in a previous email'
1365                 );
1366         }
1367
1368         /**
1369          * Denys a pending registration
1370          *
1371          * @param string $hash The hash of the pending user
1372          *
1373          * This does not have to go through user_remove() and save the nickname
1374          * permanently against re-registration, as the person was not yet
1375          * allowed to have friends on this system
1376          *
1377          * @return bool True, if the deny was successfull
1378          * @throws Exception
1379          */
1380         public static function deny(string $hash): bool
1381         {
1382                 $register = Register::getByHash($hash);
1383                 if (!DBA::isResult($register)) {
1384                         return false;
1385                 }
1386
1387                 $user = User::getById($register['uid']);
1388                 if (!DBA::isResult($user)) {
1389                         return false;
1390                 }
1391
1392                 // Delete the avatar
1393                 Photo::delete(['uid' => $register['uid']]);
1394
1395                 return DBA::delete('user', ['uid' => $register['uid']]) &&
1396                        Register::deleteByHash($register['hash']);
1397         }
1398
1399         /**
1400          * Creates a new user based on a minimal set and sends an email to this user
1401          *
1402          * @param string $name  The user's name
1403          * @param string $email The user's email address
1404          * @param string $nick  The user's nick name
1405          * @param string $lang  The user's language (default is english)
1406          * @return bool True, if the user was created successfully
1407          * @throws HTTPException\InternalServerErrorException
1408          * @throws ErrorException
1409          * @throws ImagickException
1410          */
1411         public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT): bool
1412         {
1413                 if (empty($name) ||
1414                     empty($email) ||
1415                     empty($nick)) {
1416                         throw new HTTPException\InternalServerErrorException('Invalid arguments.');
1417                 }
1418
1419                 $result = self::create([
1420                         'username' => $name,
1421                         'email' => $email,
1422                         'nickname' => $nick,
1423                         'verified' => 1,
1424                         'language' => $lang
1425                 ]);
1426
1427                 $user = $result['user'];
1428                 $preamble = Strings::deindent(DI::l10n()->t('
1429                 Dear %1$s,
1430                         the administrator of %2$s has set up an account for you.'));
1431                 $body = Strings::deindent(DI::l10n()->t('
1432                 The login details are as follows:
1433
1434                 Site Location:  %1$s
1435                 Login Name:             %2$s
1436                 Password:               %3$s
1437
1438                 You may change your password from your account "Settings" page after logging
1439                 in.
1440
1441                 Please take a few moments to review the other account settings on that page.
1442
1443                 You may also wish to add some basic information to your default profile
1444                 (on the "Profiles" page) so that other people can easily find you.
1445
1446                 We recommend setting your full name, adding a profile photo,
1447                 adding some profile "keywords" (very useful in making new friends) - and
1448                 perhaps what country you live in; if you do not wish to be more specific
1449                 than that.
1450
1451                 We fully respect your right to privacy, and none of these items are necessary.
1452                 If you are new and do not know anybody here, they may help
1453                 you to make some new and interesting friends.
1454
1455                 If you ever want to delete your account, you can do so at %1$s/settings/removeme
1456
1457                 Thank you and welcome to %4$s.'));
1458
1459                 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1460                 $body = sprintf($body, DI::baseUrl()->get(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1461
1462                 $email = DI::emailer()
1463                         ->newSystemMail()
1464                         ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1465                         ->forUser($user)
1466                         ->withRecipient($user['email'])
1467                         ->build();
1468                 return DI::emailer()->send($email);
1469         }
1470
1471         /**
1472          * Sends pending registration confirmation email
1473          *
1474          * @param array  $user     User record array
1475          * @param string $sitename
1476          * @param string $siteurl
1477          * @param string $password Plaintext password
1478          * @return NULL|boolean from notification() and email() inherited
1479          * @throws HTTPException\InternalServerErrorException
1480          */
1481         public static function sendRegisterPendingEmail(array $user, string $sitename, string $siteurl, string $password)
1482         {
1483                 $body = Strings::deindent(DI::l10n()->t(
1484                         '
1485                         Dear %1$s,
1486                                 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1487
1488                         Your login details are as follows:
1489
1490                         Site Location:  %3$s
1491                         Login Name:             %4$s
1492                         Password:               %5$s
1493                 ',
1494                         $user['username'],
1495                         $sitename,
1496                         $siteurl,
1497                         $user['nickname'],
1498                         $password
1499                 ));
1500
1501                 $email = DI::emailer()
1502                         ->newSystemMail()
1503                         ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1504                         ->forUser($user)
1505                         ->withRecipient($user['email'])
1506                         ->build();
1507                 return DI::emailer()->send($email);
1508         }
1509
1510         /**
1511          * Sends registration confirmation
1512          *
1513          * It's here as a function because the mail is sent from different parts
1514          *
1515          * @param L10n   $l10n     The used language
1516          * @param array  $user     User record array
1517          * @param string $sitename
1518          * @param string $siteurl
1519          * @param string $password Plaintext password
1520          *
1521          * @return NULL|boolean from notification() and email() inherited
1522          * @throws HTTPException\InternalServerErrorException
1523          */
1524         public static function sendRegisterOpenEmail(L10n $l10n, array $user, string $sitename, string $siteurl, string $password)
1525         {
1526                 $preamble = Strings::deindent($l10n->t(
1527                         '
1528                                 Dear %1$s,
1529                                 Thank you for registering at %2$s. Your account has been created.
1530                         ',
1531                         $user['username'],
1532                         $sitename
1533                 ));
1534                 $body = Strings::deindent($l10n->t(
1535                         '
1536                         The login details are as follows:
1537
1538                         Site Location:  %3$s
1539                         Login Name:             %1$s
1540                         Password:               %5$s
1541
1542                         You may change your password from your account "Settings" page after logging
1543                         in.
1544
1545                         Please take a few moments to review the other account settings on that page.
1546
1547                         You may also wish to add some basic information to your default profile
1548                         ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1549
1550                         We recommend setting your full name, adding a profile photo,
1551                         adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1552                         perhaps what country you live in; if you do not wish to be more specific
1553                         than that.
1554
1555                         We fully respect your right to privacy, and none of these items are necessary.
1556                         If you are new and do not know anybody here, they may help
1557                         you to make some new and interesting friends.
1558
1559                         If you ever want to delete your account, you can do so at %3$s/settings/removeme
1560
1561                         Thank you and welcome to %2$s.',
1562                         $user['nickname'],
1563                         $sitename,
1564                         $siteurl,
1565                         $user['username'],
1566                         $password
1567                 ));
1568
1569                 $email = DI::emailer()
1570                         ->newSystemMail()
1571                         ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1572                         ->forUser($user)
1573                         ->withRecipient($user['email'])
1574                         ->build();
1575                 return DI::emailer()->send($email);
1576         }
1577
1578         /**
1579          * @param int $uid user to remove
1580          * @return bool
1581          * @throws HTTPException\InternalServerErrorException
1582          */
1583         public static function remove(int $uid): bool
1584         {
1585                 if (empty($uid)) {
1586                         return false;
1587                 }
1588
1589                 Logger::notice('Removing user', ['user' => $uid]);
1590
1591                 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1592
1593                 Hook::callAll('remove_user', $user);
1594
1595                 // save username (actually the nickname as it is guaranteed
1596                 // unique), so it cannot be re-registered in the future.
1597                 DBA::insert('userd', ['username' => $user['nickname']]);
1598
1599                 // Remove all personal settings, especially connector settings
1600                 DBA::delete('pconfig', ['uid' => $uid]);
1601
1602                 // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
1603                 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1604                 Worker::add(Worker::PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1605
1606                 // Send an update to the directory
1607                 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1608                 Worker::add(Worker::PRIORITY_LOW, 'Directory', $self['url']);
1609
1610                 // Remove the user relevant data
1611                 Worker::add(Worker::PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1612
1613                 return true;
1614         }
1615
1616         /**
1617          * Return all identities to a user
1618          *
1619          * @param int $uid The user id
1620          * @return array All identities for this user
1621          *
1622          * Example for a return:
1623          *    [
1624          *        [
1625          *            'uid' => 1,
1626          *            'username' => 'maxmuster',
1627          *            'nickname' => 'Max Mustermann'
1628          *        ],
1629          *        [
1630          *            'uid' => 2,
1631          *            'username' => 'johndoe',
1632          *            'nickname' => 'John Doe'
1633          *        ]
1634          *    ]
1635          * @throws Exception
1636          */
1637         public static function identities(int $uid): array
1638         {
1639                 if (empty($uid)) {
1640                         return [];
1641                 }
1642
1643                 $identities = [];
1644
1645                 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1646                 if (!DBA::isResult($user)) {
1647                         return $identities;
1648                 }
1649
1650                 if ($user['parent-uid'] == 0) {
1651                         // First add our own entry
1652                         $identities = [[
1653                                 'uid' => $user['uid'],
1654                                 'username' => $user['username'],
1655                                 'nickname' => $user['nickname']
1656                         ]];
1657
1658                         // Then add all the children
1659                         $r = DBA::select(
1660                                 'user',
1661                                 ['uid', 'username', 'nickname'],
1662                                 ['parent-uid' => $user['uid'], 'account_removed' => false]
1663                         );
1664                         if (DBA::isResult($r)) {
1665                                 $identities = array_merge($identities, DBA::toArray($r));
1666                         }
1667                 } else {
1668                         // First entry is our parent
1669                         $r = DBA::select(
1670                                 'user',
1671                                 ['uid', 'username', 'nickname'],
1672                                 ['uid' => $user['parent-uid'], 'account_removed' => false]
1673                         );
1674                         if (DBA::isResult($r)) {
1675                                 $identities = DBA::toArray($r);
1676                         }
1677
1678                         // Then add all siblings
1679                         $r = DBA::select(
1680                                 'user',
1681                                 ['uid', 'username', 'nickname'],
1682                                 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1683                         );
1684                         if (DBA::isResult($r)) {
1685                                 $identities = array_merge($identities, DBA::toArray($r));
1686                         }
1687                 }
1688
1689                 $r = DBA::p(
1690                         "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1691                         FROM `manage`
1692                         INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1693                         WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1694                         $user['uid']
1695                 );
1696                 if (DBA::isResult($r)) {
1697                         $identities = array_merge($identities, DBA::toArray($r));
1698                 }
1699
1700                 return $identities;
1701         }
1702
1703         /**
1704          * Check if the given user id has delegations or is delegated
1705          *
1706          * @param int $uid
1707          * @return bool
1708          */
1709         public static function hasIdentities(int $uid): bool
1710         {
1711                 if (empty($uid)) {
1712                         return false;
1713                 }
1714
1715                 $user = DBA::selectFirst('user', ['parent-uid'], ['uid' => $uid, 'account_removed' => false]);
1716                 if (!DBA::isResult($user)) {
1717                         return false;
1718                 }
1719
1720                 if ($user['parent-uid'] != 0) {
1721                         return true;
1722                 }
1723
1724                 if (DBA::exists('user', ['parent-uid' => $uid, 'account_removed' => false])) {
1725                         return true;
1726                 }
1727
1728                 if (DBA::exists('manage', ['uid' => $uid])) {
1729                         return true;
1730                 }
1731
1732                 return false;
1733         }
1734
1735         /**
1736          * Returns statistical information about the current users of this node
1737          *
1738          * @return array
1739          *
1740          * @throws Exception
1741          */
1742         public static function getStatistics(): array
1743         {
1744                 $statistics = [
1745                         'total_users'           => 0,
1746                         'active_users_halfyear' => 0,
1747                         'active_users_monthly'  => 0,
1748                         'active_users_weekly'   => 0,
1749                 ];
1750
1751                 $userStmt = DBA::select('owner-view', ['uid', 'last-activity', 'last-item'],
1752                         ["`verified` AND `last-activity` > ? AND NOT `blocked`
1753                         AND NOT `account_removed` AND NOT `account_expired`",
1754                         DBA::NULL_DATETIME]);
1755                 if (!DBA::isResult($userStmt)) {
1756                         return $statistics;
1757                 }
1758
1759                 $halfyear = time() - (180 * 24 * 60 * 60);
1760                 $month = time() - (30 * 24 * 60 * 60);
1761                 $week = time() - (7 * 24 * 60 * 60);
1762
1763                 while ($user = DBA::fetch($userStmt)) {
1764                         $statistics['total_users']++;
1765
1766                         if ((strtotime($user['last-activity']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1767                         ) {
1768                                 $statistics['active_users_halfyear']++;
1769                         }
1770
1771                         if ((strtotime($user['last-activity']) > $month) || (strtotime($user['last-item']) > $month)
1772                         ) {
1773                                 $statistics['active_users_monthly']++;
1774                         }
1775
1776                         if ((strtotime($user['last-activity']) > $week) || (strtotime($user['last-item']) > $week)
1777                         ) {
1778                                 $statistics['active_users_weekly']++;
1779                         }
1780                 }
1781                 DBA::close($userStmt);
1782
1783                 return $statistics;
1784         }
1785
1786         /**
1787          * Get all users of the current node
1788          *
1789          * @param int    $start Start count (Default is 0)
1790          * @param int    $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1791          * @param string $type  The type of users, which should get (all, bocked, removed)
1792          * @param string $order Order of the user list (Default is 'contact.name')
1793          * @param bool   $descending Order direction (Default is ascending)
1794          * @return array|bool The list of the users
1795          * @throws Exception
1796          */
1797         public static function getList(int $start = 0, int $count = Pager::ITEMS_PER_PAGE, string $type = 'all', string $order = 'name', bool $descending = false)
1798         {
1799                 $param = ['limit' => [$start, $count], 'order' => [$order => $descending]];
1800                 $condition = [];
1801                 switch ($type) {
1802                         case 'active':
1803                                 $condition['account_removed'] = false;
1804                                 $condition['blocked'] = false;
1805                                 break;
1806
1807                         case 'blocked':
1808                                 $condition['account_removed'] = false;
1809                                 $condition['blocked'] = true;
1810                                 $condition['verified'] = true;
1811                                 break;
1812
1813                         case 'removed':
1814                                 $condition['account_removed'] = true;
1815                                 break;
1816                 }
1817
1818                 return DBA::selectToArray('owner-view', [], $condition, $param);
1819         }
1820
1821         /**
1822          * Returns a list of lowercase admin email addresses from the comma-separated list in the config
1823          *
1824          * @return array
1825          */
1826         public static function getAdminEmailList(): array
1827         {
1828                 $adminEmails = strtolower(str_replace(' ', '', DI::config()->get('config', 'admin_email')));
1829                 if (!$adminEmails) {
1830                         return [];
1831                 }
1832
1833                 return explode(',', $adminEmails);
1834         }
1835
1836         /**
1837          * Returns the complete list of admin user accounts
1838          *
1839          * @param array $fields
1840          * @return array
1841          * @throws Exception
1842          */
1843         public static function getAdminList(array $fields = []): array
1844         {
1845                 $condition = [
1846                         'email'           => self::getAdminEmailList(),
1847                         'parent-uid'      => 0,
1848                         'blocked'         => 0,
1849                         'verified'        => true,
1850                         'account_removed' => false,
1851                         'account_expired' => false,
1852                 ];
1853
1854                 return DBA::selectToArray('user', $fields, $condition, ['order' => ['uid']]);
1855         }
1856
1857         /**
1858          * Return a list of admin user accounts where each unique email address appears only once.
1859          *
1860          * This method is meant for admin notifications that do not need to be sent multiple times to the same email address.
1861          *
1862          * @param array $fields
1863          * @return array
1864          * @throws Exception
1865          */
1866         public static function getAdminListForEmailing(array $fields = []): array
1867         {
1868                 return array_filter(self::getAdminList($fields), function ($user) {
1869                         static $emails = [];
1870
1871                         if (in_array($user['email'], $emails)) {
1872                                 return false;
1873                         }
1874
1875                         $emails[] = $user['email'];
1876
1877                         return true;
1878                 });
1879         }
1880 }