3 * @copyright Copyright (C) 2020, Friendica
5 * @license GNU AGPL version 3 or any later version
7 * This program is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU Affero General Public License as
9 * published by the Free Software Foundation, either version 3 of the
10 * License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Affero General Public License for more details.
17 * You should have received a copy of the GNU Affero General Public License
18 * along with this program. If not, see <https://www.gnu.org/licenses/>.
22 namespace Friendica\Model;
24 use DivineOmega\DOFileCachePSR6\CacheItemPool;
25 use DivineOmega\PasswordExposed;
28 use Friendica\Content\Pager;
29 use Friendica\Core\Hook;
30 use Friendica\Core\L10n;
31 use Friendica\Core\Logger;
32 use Friendica\Core\Protocol;
33 use Friendica\Core\System;
34 use Friendica\Core\Worker;
35 use Friendica\Database\DBA;
37 use Friendica\Model\TwoFactor\AppSpecificPassword;
38 use Friendica\Network\HTTPException;
39 use Friendica\Object\Image;
40 use Friendica\Util\Crypto;
41 use Friendica\Util\DateTimeFormat;
42 use Friendica\Util\Images;
43 use Friendica\Util\Network;
44 use Friendica\Util\Proxy;
45 use Friendica\Util\Strings;
46 use Friendica\Worker\Delivery;
51 * This class handles User related functions
58 * PAGE_FLAGS_NORMAL is a typical personal profile account
59 * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
60 * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
61 * write access to wall and comments (no email and not included in page owner's ACL lists)
62 * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
66 const PAGE_FLAGS_NORMAL = 0;
67 const PAGE_FLAGS_SOAPBOX = 1;
68 const PAGE_FLAGS_COMMUNITY = 2;
69 const PAGE_FLAGS_FREELOVE = 3;
70 const PAGE_FLAGS_BLOG = 4;
71 const PAGE_FLAGS_PRVGROUP = 5;
79 * ACCOUNT_TYPE_PERSON - the account belongs to a person
80 * Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
82 * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
83 * Associated page type: PAGE_FLAGS_SOAPBOX
85 * ACCOUNT_TYPE_NEWS - the account is a news reflector
86 * Associated page type: PAGE_FLAGS_SOAPBOX
88 * ACCOUNT_TYPE_COMMUNITY - the account is community forum
89 * Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
91 * ACCOUNT_TYPE_RELAY - the account is a relay
92 * This will only be assigned to contacts, not to user accounts
95 const ACCOUNT_TYPE_PERSON = 0;
96 const ACCOUNT_TYPE_ORGANISATION = 1;
97 const ACCOUNT_TYPE_NEWS = 2;
98 const ACCOUNT_TYPE_COMMUNITY = 3;
99 const ACCOUNT_TYPE_RELAY = 4;
104 private static $owner;
107 * Returns the numeric account type by their string
109 * @param string $accounttype as string constant
110 * @return int|null Numeric account type - or null when not set
112 public static function getAccountTypeByString(string $accounttype)
114 switch ($accounttype) {
116 return User::ACCOUNT_TYPE_PERSON;
118 return User::ACCOUNT_TYPE_ORGANISATION;
120 return User::ACCOUNT_TYPE_NEWS;
122 return User::ACCOUNT_TYPE_COMMUNITY;
130 * Fetch the system account
132 * @return array system account
134 public static function getSystemAccount()
136 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
137 if (!DBA::isResult($system)) {
138 self::createSystemAccount();
139 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
140 if (!DBA::isResult($system)) {
145 $system['sprvkey'] = $system['uprvkey'] = $system['prvkey'];
146 $system['spubkey'] = $system['upubkey'] = $system['pubkey'];
147 $system['nickname'] = $system['nick'];
149 // Ensure that the user contains data
150 $user = DBA::selectFirst('user', ['prvkey'], ['uid' => 0]);
151 if (empty($user['prvkey'])) {
153 'username' => $system['name'],
154 'nickname' => $system['nick'],
155 'register_date' => $system['created'],
156 'pubkey' => $system['pubkey'],
157 'prvkey' => $system['prvkey'],
158 'spubkey' => $system['spubkey'],
159 'sprvkey' => $system['sprvkey'],
161 'page-flags' => User::PAGE_FLAGS_SOAPBOX,
162 'account-type' => User::ACCOUNT_TYPE_RELAY,
165 DBA::update('user', $fields, ['uid' => 0]);
172 * Create the system account
176 private static function createSystemAccount()
178 $system_actor_name = self::getActorName();
179 if (empty($system_actor_name)) {
183 $keys = Crypto::newKeypair(4096);
184 if ($keys === false) {
185 throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
190 $system['created'] = DateTimeFormat::utcNow();
191 $system['self'] = true;
192 $system['network'] = Protocol::ACTIVITYPUB;
193 $system['name'] = 'System Account';
194 $system['addr'] = $system_actor_name . '@' . DI::baseUrl()->getHostname();
195 $system['nick'] = $system_actor_name;
196 $system['url'] = DI::baseUrl() . '/friendica';
198 $system['avatar'] = $system['photo'] = Contact::getDefaultAvatar($system, Proxy::SIZE_SMALL);
199 $system['thumb'] = Contact::getDefaultAvatar($system, Proxy::SIZE_THUMB);
200 $system['micro'] = Contact::getDefaultAvatar($system, Proxy::SIZE_MICRO);
202 $system['nurl'] = Strings::normaliseLink($system['url']);
203 $system['pubkey'] = $keys['pubkey'];
204 $system['prvkey'] = $keys['prvkey'];
205 $system['blocked'] = 0;
206 $system['pending'] = 0;
207 $system['contact-type'] = Contact::TYPE_RELAY; // In AP this is translated to 'Application'
208 $system['name-date'] = DateTimeFormat::utcNow();
209 $system['uri-date'] = DateTimeFormat::utcNow();
210 $system['avatar-date'] = DateTimeFormat::utcNow();
211 $system['closeness'] = 0;
212 $system['baseurl'] = DI::baseUrl();
213 $system['gsid'] = GServer::getID($system['baseurl']);
214 DBA::insert('contact', $system);
218 * Detect a usable actor name
220 * @return string actor account name
222 public static function getActorName()
224 $system_actor_name = DI::config()->get('system', 'actor_name');
225 if (!empty($system_actor_name)) {
226 $self = Contact::selectFirst(['nick'], ['uid' => 0, 'self' => true]);
227 if (!empty($self['nick'])) {
228 if ($self['nick'] != $system_actor_name) {
229 // Reset the actor name to the already used name
230 DI::config()->set('system', 'actor_name', $self['nick']);
231 $system_actor_name = $self['nick'];
234 return $system_actor_name;
237 // List of possible actor names
238 $possible_accounts = ['friendica', 'actor', 'system', 'internal'];
239 foreach ($possible_accounts as $name) {
240 if (!DBA::exists('user', ['nickname' => $name, 'account_removed' => false, 'expire' => false]) &&
241 !DBA::exists('userd', ['username' => $name])) {
242 DI::config()->set('system', 'actor_name', $name);
250 * Returns true if a user record exists with the provided id
252 * @param integer $uid
256 public static function exists($uid)
258 return DBA::exists('user', ['uid' => $uid]);
262 * @param integer $uid
263 * @param array $fields
264 * @return array|boolean User record if it exists, false otherwise
267 public static function getById($uid, array $fields = [])
269 return !empty($uid) ? DBA::selectFirst('user', $fields, ['uid' => $uid]) : [];
273 * Returns a user record based on it's GUID
275 * @param string $guid The guid of the user
276 * @param array $fields The fields to retrieve
277 * @param bool $active True, if only active records are searched
279 * @return array|boolean User record if it exists, false otherwise
282 public static function getByGuid(string $guid, array $fields = [], bool $active = true)
285 $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
287 $cond = ['guid' => $guid];
290 return DBA::selectFirst('user', $fields, $cond);
294 * @param string $nickname
295 * @param array $fields
296 * @return array|boolean User record if it exists, false otherwise
299 public static function getByNickname($nickname, array $fields = [])
301 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
305 * Returns the user id of a given profile URL
309 * @return integer user id
312 public static function getIdForURL(string $url)
314 // Avoid any database requests when the hostname isn't even part of the url.
315 if (!strpos($url, DI::baseUrl()->getHostname())) {
319 $self = Contact::selectFirst(['uid'], ['self' => true, 'nurl' => Strings::normaliseLink($url)]);
320 if (!empty($self['uid'])) {
324 $self = Contact::selectFirst(['uid'], ['self' => true, 'addr' => $url]);
325 if (!empty($self['uid'])) {
329 $self = Contact::selectFirst(['uid'], ['self' => true, 'alias' => [$url, Strings::normaliseLink($url)]]);
330 if (!empty($self['uid'])) {
338 * Get a user based on its email
340 * @param string $email
341 * @param array $fields
343 * @return array|boolean User record if it exists, false otherwise
347 public static function getByEmail($email, array $fields = [])
349 return DBA::selectFirst('user', $fields, ['email' => $email]);
353 * Fetch the user array of the administrator. The first one if there are several.
355 * @param array $fields
358 public static function getFirstAdmin(array $fields = [])
360 if (!empty(DI::config()->get('config', 'admin_nickname'))) {
361 return self::getByNickname(DI::config()->get('config', 'admin_nickname'), $fields);
362 } elseif (!empty(DI::config()->get('config', 'admin_email'))) {
363 $adminList = explode(',', str_replace(' ', '', DI::config()->get('config', 'admin_email')));
364 return self::getByEmail($adminList[0], $fields);
371 * Get owner data by user id
374 * @param boolean $repairMissing Repair the owner data if it's missing
375 * @return boolean|array
378 public static function getOwnerDataById(int $uid, bool $repairMissing = true)
381 return self::getSystemAccount();
384 if (!empty(self::$owner[$uid])) {
385 return self::$owner[$uid];
388 $owner = DBA::selectFirst('owner-view', [], ['uid' => $uid]);
389 if (!DBA::isResult($owner)) {
390 if (!DBA::exists('user', ['uid' => $uid]) || !$repairMissing) {
393 Contact::createSelfFromUserId($uid);
394 $owner = self::getOwnerDataById($uid, false);
397 if (empty($owner['nickname'])) {
401 if (!$repairMissing) {
405 // Check if the returned data is valid, otherwise fix it. See issue #6122
407 // Check for correct url and normalised nurl
408 $url = DI::baseUrl() . '/profile/' . $owner['nickname'];
409 $repair = ($owner['url'] != $url) || ($owner['nurl'] != Strings::normaliseLink($owner['url']));
412 // Check if "addr" is present and correct
413 $addr = $owner['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
414 $repair = ($addr != $owner['addr']) || empty($owner['prvkey']) || empty($owner['pubkey']);
418 // Check if the avatar field is filled and the photo directs to the correct path
419 $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
420 if (DBA::isResult($avatar)) {
421 $repair = empty($owner['avatar']) || !strpos($owner['photo'], $avatar['resource-id']);
426 Contact::updateSelfFromUserID($uid);
427 // Return the corrected data and avoid a loop
428 $owner = self::getOwnerDataById($uid, false);
431 self::$owner[$uid] = $owner;
436 * Get owner data by nick name
439 * @return boolean|array
442 public static function getOwnerDataByNick($nick)
444 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
446 if (!DBA::isResult($user)) {
450 return self::getOwnerDataById($user['uid']);
454 * Returns the default group for a given user and network
456 * @param int $uid User id
457 * @param string $network network name
459 * @return int group id
462 public static function getDefaultGroup($uid, $network = '')
466 if ($network == Protocol::OSTATUS) {
467 $default_group = DI::pConfig()->get($uid, "ostatus", "default_group");
470 if ($default_group != 0) {
471 return $default_group;
474 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
476 if (DBA::isResult($user)) {
477 $default_group = $user["def_gid"];
480 return $default_group;
485 * Authenticate a user with a clear text password
487 * @param mixed $user_info
488 * @param string $password
489 * @param bool $third_party
490 * @return int|boolean
491 * @deprecated since version 3.6
492 * @see User::getIdFromPasswordAuthentication()
494 public static function authenticate($user_info, $password, $third_party = false)
497 return self::getIdFromPasswordAuthentication($user_info, $password, $third_party);
498 } catch (Exception $ex) {
504 * Authenticate a user with a clear text password
506 * Returns the user id associated with a successful password authentication
508 * @param mixed $user_info
509 * @param string $password
510 * @param bool $third_party
511 * @return int User Id if authentication is successful
512 * @throws HTTPException\ForbiddenException
513 * @throws HTTPException\NotFoundException
515 public static function getIdFromPasswordAuthentication($user_info, $password, $third_party = false)
517 $user = self::getAuthenticationInfo($user_info);
519 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
520 // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
521 if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
524 } elseif (strpos($user['password'], '$') === false) {
525 //Legacy hash that has not been replaced by a new hash yet
526 if (self::hashPasswordLegacy($password) === $user['password']) {
527 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
531 } elseif (!empty($user['legacy_password'])) {
532 //Legacy hash that has been double-hashed and not replaced by a new hash yet
533 //Warning: `legacy_password` is not necessary in sync with the content of `password`
534 if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
535 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
539 } elseif (password_verify($password, $user['password'])) {
541 if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
542 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
548 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
552 * Returns authentication info from various parameters types
554 * User info can be any of the following:
557 * - User email or username or nickname
558 * - User array with at least the uid and the hashed password
560 * @param mixed $user_info
562 * @throws HTTPException\NotFoundException
564 public static function getAuthenticationInfo($user_info)
568 if (is_object($user_info) || is_array($user_info)) {
569 if (is_object($user_info)) {
570 $user = (array) $user_info;
577 || !isset($user['password'])
578 || !isset($user['legacy_password'])
580 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
582 } elseif (is_int($user_info) || is_string($user_info)) {
583 if (is_int($user_info)) {
584 $user = DBA::selectFirst(
586 ['uid', 'password', 'legacy_password'],
590 'account_expired' => 0,
591 'account_removed' => 0,
596 $fields = ['uid', 'password', 'legacy_password'];
598 "(`email` = ? OR `username` = ? OR `nickname` = ?)
599 AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
600 $user_info, $user_info, $user_info
602 $user = DBA::selectFirst('user', $fields, $condition);
605 if (!DBA::isResult($user)) {
606 throw new HTTPException\NotFoundException(DI::l10n()->t('User not found'));
614 * Generates a human-readable random password
619 public static function generateNewPassword()
621 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
625 * Checks if the provided plaintext password has been exposed or not
627 * @param string $password
631 public static function isPasswordExposed($password)
633 $cache = new CacheItemPool();
634 $cache->changeConfig([
635 'cacheDirectory' => get_temppath() . '/password-exposed-cache/',
639 $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
641 return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
642 } catch (Exception $e) {
643 Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
644 'code' => $e->getCode(),
645 'file' => $e->getFile(),
646 'line' => $e->getLine(),
647 'trace' => $e->getTraceAsString()
655 * Legacy hashing function, kept for password migration purposes
657 * @param string $password
660 private static function hashPasswordLegacy($password)
662 return hash('whirlpool', $password);
666 * Global user password hashing function
668 * @param string $password
672 public static function hashPassword($password)
674 if (!trim($password)) {
675 throw new Exception(DI::l10n()->t('Password can\'t be empty'));
678 return password_hash($password, PASSWORD_DEFAULT);
682 * Updates a user row with a new plaintext password
685 * @param string $password
689 public static function updatePassword($uid, $password)
691 $password = trim($password);
693 if (empty($password)) {
694 throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
697 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
698 throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
701 $allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
703 if (!preg_match('/^[a-z0-9' . preg_quote($allowed_characters, '/') . ']+$/i', $password)) {
704 throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
707 return self::updatePasswordHashed($uid, self::hashPassword($password));
711 * Updates a user row with a new hashed password.
712 * Empties the password reset token field just in case.
715 * @param string $pasword_hashed
719 private static function updatePasswordHashed($uid, $pasword_hashed)
722 'password' => $pasword_hashed,
724 'pwdreset_time' => null,
725 'legacy_password' => false
727 return DBA::update('user', $fields, ['uid' => $uid]);
731 * Checks if a nickname is in the list of the forbidden nicknames
733 * Check if a nickname is forbidden from registration on the node by the
734 * admin. Forbidden nicknames (e.g. role namess) can be configured in the
737 * @param string $nickname The nickname that should be checked
738 * @return boolean True is the nickname is blocked on the node
740 public static function isNicknameBlocked($nickname)
742 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
743 if (!empty($forbidden_nicknames)) {
744 $forbidden = explode(',', $forbidden_nicknames);
745 $forbidden = array_map('trim', $forbidden);
750 // Add the name of the internal actor to the "forbidden" list
751 $actor_name = self::getActorName();
752 if (!empty($actor_name)) {
753 $forbidden[] = $actor_name;
756 if (empty($forbidden)) {
760 // check if the nickname is in the list of blocked nicknames
761 if (in_array(strtolower($nickname), $forbidden)) {
770 * Catch-all user creation function
772 * Creates a user from the provided data array, either form fields or OpenID.
773 * Required: { username, nickname, email } or { openid_url }
775 * Performs the following:
776 * - Sends to the OpenId auth URL (if relevant)
777 * - Creates new key pairs for crypto
778 * - Create self-contact
779 * - Create profile image
783 * @throws ErrorException
784 * @throws HTTPException\InternalServerErrorException
785 * @throws ImagickException
788 public static function create(array $data)
790 $return = ['user' => null, 'password' => ''];
792 $using_invites = DI::config()->get('system', 'invitation_only');
794 $invite_id = !empty($data['invite_id']) ? Strings::escapeTags(trim($data['invite_id'])) : '';
795 $username = !empty($data['username']) ? Strings::escapeTags(trim($data['username'])) : '';
796 $nickname = !empty($data['nickname']) ? Strings::escapeTags(trim($data['nickname'])) : '';
797 $email = !empty($data['email']) ? Strings::escapeTags(trim($data['email'])) : '';
798 $openid_url = !empty($data['openid_url']) ? Strings::escapeTags(trim($data['openid_url'])) : '';
799 $photo = !empty($data['photo']) ? Strings::escapeTags(trim($data['photo'])) : '';
800 $password = !empty($data['password']) ? trim($data['password']) : '';
801 $password1 = !empty($data['password1']) ? trim($data['password1']) : '';
802 $confirm = !empty($data['confirm']) ? trim($data['confirm']) : '';
803 $blocked = !empty($data['blocked']);
804 $verified = !empty($data['verified']);
805 $language = !empty($data['language']) ? Strings::escapeTags(trim($data['language'])) : 'en';
807 $netpublish = $publish = !empty($data['profile_publish_reg']);
809 if ($password1 != $confirm) {
810 throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
811 } elseif ($password1 != '') {
812 $password = $password1;
815 if ($using_invites) {
817 throw new Exception(DI::l10n()->t('An invitation is required.'));
820 if (!Register::existsByHash($invite_id)) {
821 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
825 /// @todo Check if this part is really needed. We should have fetched all this data in advance
826 if (empty($username) || empty($email) || empty($nickname)) {
828 if (!Network::isUrlValid($openid_url)) {
829 throw new Exception(DI::l10n()->t('Invalid OpenID url'));
831 $_SESSION['register'] = 1;
832 $_SESSION['openid'] = $openid_url;
834 $openid = new LightOpenID(DI::baseUrl()->getHostname());
835 $openid->identity = $openid_url;
836 $openid->returnUrl = DI::baseUrl() . '/openid';
837 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
838 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
840 $authurl = $openid->authUrl();
841 } catch (Exception $e) {
842 throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . EOL . EOL . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
844 System::externalRedirect($authurl);
848 throw new Exception(DI::l10n()->t('Please enter the required information.'));
851 if (!Network::isUrlValid($openid_url)) {
855 // collapse multiple spaces in name
856 $username = preg_replace('/ +/', ' ', $username);
858 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
859 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
861 if ($username_min_length > $username_max_length) {
862 Logger::log(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length), Logger::WARNING);
863 $tmp = $username_min_length;
864 $username_min_length = $username_max_length;
865 $username_max_length = $tmp;
868 if (mb_strlen($username) < $username_min_length) {
869 throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
872 if (mb_strlen($username) > $username_max_length) {
873 throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
876 // So now we are just looking for a space in the full name.
877 $loose_reg = DI::config()->get('system', 'no_regfullname');
879 $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
880 if (strpos($username, ' ') === false) {
881 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
885 if (!Network::isEmailDomainAllowed($email)) {
886 throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
889 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
890 throw new Exception(DI::l10n()->t('Not a valid email address.'));
892 if (self::isNicknameBlocked($nickname)) {
893 throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
896 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
897 throw new Exception(DI::l10n()->t('Cannot use that email.'));
900 // Disallow somebody creating an account using openid that uses the admin email address,
901 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
902 if (DI::config()->get('config', 'admin_email') && strlen($openid_url)) {
903 $adminlist = explode(',', str_replace(' ', '', strtolower(DI::config()->get('config', 'admin_email'))));
904 if (in_array(strtolower($email), $adminlist)) {
905 throw new Exception(DI::l10n()->t('Cannot use that email.'));
909 $nickname = $data['nickname'] = strtolower($nickname);
911 if (!preg_match('/^[a-z0-9][a-z0-9_]*$/', $nickname)) {
912 throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
915 // Check existing and deleted accounts for this nickname.
917 DBA::exists('user', ['nickname' => $nickname])
918 || DBA::exists('userd', ['username' => $nickname])
920 throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
923 $new_password = strlen($password) ? $password : User::generateNewPassword();
924 $new_password_encoded = self::hashPassword($new_password);
926 $return['password'] = $new_password;
928 $keys = Crypto::newKeypair(4096);
929 if ($keys === false) {
930 throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
933 $prvkey = $keys['prvkey'];
934 $pubkey = $keys['pubkey'];
936 // Create another keypair for signing/verifying salmon protocol messages.
937 $sres = Crypto::newKeypair(512);
938 $sprvkey = $sres['prvkey'];
939 $spubkey = $sres['pubkey'];
941 $insert_result = DBA::insert('user', [
942 'guid' => System::createUUID(),
943 'username' => $username,
944 'password' => $new_password_encoded,
946 'openid' => $openid_url,
947 'nickname' => $nickname,
950 'spubkey' => $spubkey,
951 'sprvkey' => $sprvkey,
952 'verified' => $verified,
953 'blocked' => $blocked,
954 'language' => $language,
956 'register_date' => DateTimeFormat::utcNow(),
957 'default-location' => ''
960 if ($insert_result) {
961 $uid = DBA::lastInsertId();
962 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
964 throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
968 throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
971 // if somebody clicked submit twice very quickly, they could end up with two accounts
972 // due to race condition. Remove this one.
973 $user_count = DBA::count('user', ['nickname' => $nickname]);
974 if ($user_count > 1) {
975 DBA::delete('user', ['uid' => $uid]);
977 throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
980 $insert_result = DBA::insert('profile', [
983 'photo' => DI::baseUrl() . "/photo/profile/{$uid}.jpg",
984 'thumb' => DI::baseUrl() . "/photo/avatar/{$uid}.jpg",
985 'publish' => $publish,
986 'net-publish' => $netpublish,
988 if (!$insert_result) {
989 DBA::delete('user', ['uid' => $uid]);
991 throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
994 // Create the self contact
995 if (!Contact::createSelfFromUserId($uid)) {
996 DBA::delete('user', ['uid' => $uid]);
998 throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
1001 // Create a group with no members. This allows somebody to use it
1002 // right away as a default group for new contacts.
1003 $def_gid = Group::create($uid, DI::l10n()->t('Friends'));
1005 DBA::delete('user', ['uid' => $uid]);
1007 throw new Exception(DI::l10n()->t('An error occurred creating your default contact group. Please try again.'));
1010 $fields = ['def_gid' => $def_gid];
1011 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
1012 $fields['allow_gid'] = '<' . $def_gid . '>';
1015 DBA::update('user', $fields, ['uid' => $uid]);
1017 // if we have no OpenID photo try to look up an avatar
1018 if (!strlen($photo)) {
1019 $photo = Network::lookupAvatarByEmail($email);
1022 // unless there is no avatar-addon loaded
1023 if (strlen($photo)) {
1024 $photo_failure = false;
1026 $filename = basename($photo);
1027 $curlResult = DI::httpRequest()->get($photo);
1028 if ($curlResult->isSuccess()) {
1029 $img_str = $curlResult->getBody();
1030 $type = $curlResult->getContentType();
1036 $type = Images::getMimeTypeByData($img_str, $photo, $type);
1038 $Image = new Image($img_str, $type);
1039 if ($Image->isValid()) {
1040 $Image->scaleToSquare(300);
1042 $resource_id = Photo::newResource();
1044 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 4);
1047 $photo_failure = true;
1050 $Image->scaleDown(80);
1052 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 5);
1055 $photo_failure = true;
1058 $Image->scaleDown(48);
1060 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 6);
1063 $photo_failure = true;
1066 if (!$photo_failure) {
1067 Photo::update(['profile' => 1], ['resource-id' => $resource_id]);
1072 Hook::callAll('register_account', $uid);
1074 $return['user'] = $user;
1079 * Sets block state for a given user
1081 * @param int $uid The user id
1082 * @param bool $block Block state (default is true)
1084 * @return bool True, if successfully blocked
1088 public static function block(int $uid, bool $block = true)
1090 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
1094 * Allows a registration based on a hash
1096 * @param string $hash
1098 * @return bool True, if the allow was successful
1100 * @throws HTTPException\InternalServerErrorException
1103 public static function allow(string $hash)
1105 $register = Register::getByHash($hash);
1106 if (!DBA::isResult($register)) {
1110 $user = User::getById($register['uid']);
1111 if (!DBA::isResult($user)) {
1115 Register::deleteByHash($hash);
1117 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
1119 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
1121 if (DBA::isResult($profile) && $profile['net-publish'] && DI::config()->get('system', 'directory')) {
1122 $url = DI::baseUrl() . '/profile/' . $user['nickname'];
1123 Worker::add(PRIORITY_LOW, "Directory", $url);
1126 $l10n = DI::l10n()->withLang($register['language']);
1128 return User::sendRegisterOpenEmail(
1131 DI::config()->get('config', 'sitename'),
1132 DI::baseUrl()->get(),
1133 ($register['password'] ?? '') ?: 'Sent in a previous email'
1138 * Denys a pending registration
1140 * @param string $hash The hash of the pending user
1142 * This does not have to go through user_remove() and save the nickname
1143 * permanently against re-registration, as the person was not yet
1144 * allowed to have friends on this system
1146 * @return bool True, if the deny was successfull
1149 public static function deny(string $hash)
1151 $register = Register::getByHash($hash);
1152 if (!DBA::isResult($register)) {
1156 $user = User::getById($register['uid']);
1157 if (!DBA::isResult($user)) {
1161 return DBA::delete('user', ['uid' => $register['uid']]) &&
1162 Register::deleteByHash($register['hash']);
1166 * Creates a new user based on a minimal set and sends an email to this user
1168 * @param string $name The user's name
1169 * @param string $email The user's email address
1170 * @param string $nick The user's nick name
1171 * @param string $lang The user's language (default is english)
1173 * @return bool True, if the user was created successfully
1174 * @throws HTTPException\InternalServerErrorException
1175 * @throws ErrorException
1176 * @throws ImagickException
1178 public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT)
1183 throw new HTTPException\InternalServerErrorException('Invalid arguments.');
1186 $result = self::create([
1187 'username' => $name,
1189 'nickname' => $nick,
1194 $user = $result['user'];
1195 $preamble = Strings::deindent(DI::l10n()->t('
1197 the administrator of %2$s has set up an account for you.'));
1198 $body = Strings::deindent(DI::l10n()->t('
1199 The login details are as follows:
1205 You may change your password from your account "Settings" page after logging
1208 Please take a few moments to review the other account settings on that page.
1210 You may also wish to add some basic information to your default profile
1211 (on the "Profiles" page) so that other people can easily find you.
1213 We recommend setting your full name, adding a profile photo,
1214 adding some profile "keywords" (very useful in making new friends) - and
1215 perhaps what country you live in; if you do not wish to be more specific
1218 We fully respect your right to privacy, and none of these items are necessary.
1219 If you are new and do not know anybody here, they may help
1220 you to make some new and interesting friends.
1222 If you ever want to delete your account, you can do so at %1$s/removeme
1224 Thank you and welcome to %4$s.'));
1226 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1227 $body = sprintf($body, DI::baseUrl()->get(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1229 $email = DI::emailer()
1231 ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1233 ->withRecipient($user['email'])
1235 return DI::emailer()->send($email);
1239 * Sends pending registration confirmation email
1241 * @param array $user User record array
1242 * @param string $sitename
1243 * @param string $siteurl
1244 * @param string $password Plaintext password
1245 * @return NULL|boolean from notification() and email() inherited
1246 * @throws HTTPException\InternalServerErrorException
1248 public static function sendRegisterPendingEmail($user, $sitename, $siteurl, $password)
1250 $body = Strings::deindent(DI::l10n()->t(
1253 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1255 Your login details are as follows:
1268 $email = DI::emailer()
1270 ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1272 ->withRecipient($user['email'])
1274 return DI::emailer()->send($email);
1278 * Sends registration confirmation
1280 * It's here as a function because the mail is sent from different parts
1282 * @param L10n $l10n The used language
1283 * @param array $user User record array
1284 * @param string $sitename
1285 * @param string $siteurl
1286 * @param string $password Plaintext password
1288 * @return NULL|boolean from notification() and email() inherited
1289 * @throws HTTPException\InternalServerErrorException
1291 public static function sendRegisterOpenEmail(L10n $l10n, $user, $sitename, $siteurl, $password)
1293 $preamble = Strings::deindent($l10n->t(
1296 Thank you for registering at %2$s. Your account has been created.
1301 $body = Strings::deindent($l10n->t(
1303 The login details are as follows:
1309 You may change your password from your account "Settings" page after logging
1312 Please take a few moments to review the other account settings on that page.
1314 You may also wish to add some basic information to your default profile
1315 ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1317 We recommend setting your full name, adding a profile photo,
1318 adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1319 perhaps what country you live in; if you do not wish to be more specific
1322 We fully respect your right to privacy, and none of these items are necessary.
1323 If you are new and do not know anybody here, they may help
1324 you to make some new and interesting friends.
1326 If you ever want to delete your account, you can do so at %3$s/removeme
1328 Thank you and welcome to %2$s.',
1336 $email = DI::emailer()
1338 ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1340 ->withRecipient($user['email'])
1342 return DI::emailer()->send($email);
1346 * @param int $uid user to remove
1348 * @throws HTTPException\InternalServerErrorException
1350 public static function remove(int $uid)
1356 Logger::log('Removing user: ' . $uid);
1358 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1360 Hook::callAll('remove_user', $user);
1362 // save username (actually the nickname as it is guaranteed
1363 // unique), so it cannot be re-registered in the future.
1364 DBA::insert('userd', ['username' => $user['nickname']]);
1366 // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
1367 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1368 Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1370 // Send an update to the directory
1371 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1372 Worker::add(PRIORITY_LOW, 'Directory', $self['url']);
1374 // Remove the user relevant data
1375 Worker::add(PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1381 * Return all identities to a user
1383 * @param int $uid The user id
1384 * @return array All identities for this user
1386 * Example for a return:
1390 * 'username' => 'maxmuster',
1391 * 'nickname' => 'Max Mustermann'
1395 * 'username' => 'johndoe',
1396 * 'nickname' => 'John Doe'
1401 public static function identities($uid)
1405 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1406 if (!DBA::isResult($user)) {
1410 if ($user['parent-uid'] == 0) {
1411 // First add our own entry
1413 'uid' => $user['uid'],
1414 'username' => $user['username'],
1415 'nickname' => $user['nickname']
1418 // Then add all the children
1421 ['uid', 'username', 'nickname'],
1422 ['parent-uid' => $user['uid'], 'account_removed' => false]
1424 if (DBA::isResult($r)) {
1425 $identities = array_merge($identities, DBA::toArray($r));
1428 // First entry is our parent
1431 ['uid', 'username', 'nickname'],
1432 ['uid' => $user['parent-uid'], 'account_removed' => false]
1434 if (DBA::isResult($r)) {
1435 $identities = DBA::toArray($r);
1438 // Then add all siblings
1441 ['uid', 'username', 'nickname'],
1442 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1444 if (DBA::isResult($r)) {
1445 $identities = array_merge($identities, DBA::toArray($r));
1450 "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1452 INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1453 WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1456 if (DBA::isResult($r)) {
1457 $identities = array_merge($identities, DBA::toArray($r));
1464 * Returns statistical information about the current users of this node
1470 public static function getStatistics()
1474 'active_users_halfyear' => 0,
1475 'active_users_monthly' => 0,
1476 'active_users_weekly' => 0,
1479 $userStmt = DBA::select('owner-view', ['uid', 'login_date', 'last-item'],
1480 ["`verified` AND `login_date` > ? AND NOT `blocked`
1481 AND NOT `account_removed` AND NOT `account_expired`",
1482 DBA::NULL_DATETIME]);
1483 if (!DBA::isResult($userStmt)) {
1487 $halfyear = time() - (180 * 24 * 60 * 60);
1488 $month = time() - (30 * 24 * 60 * 60);
1489 $week = time() - (7 * 24 * 60 * 60);
1491 while ($user = DBA::fetch($userStmt)) {
1492 $statistics['total_users']++;
1494 if ((strtotime($user['login_date']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1496 $statistics['active_users_halfyear']++;
1499 if ((strtotime($user['login_date']) > $month) || (strtotime($user['last-item']) > $month)
1501 $statistics['active_users_monthly']++;
1504 if ((strtotime($user['login_date']) > $week) || (strtotime($user['last-item']) > $week)
1506 $statistics['active_users_weekly']++;
1509 DBA::close($userStmt);
1515 * Get all users of the current node
1517 * @param int $start Start count (Default is 0)
1518 * @param int $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1519 * @param string $type The type of users, which should get (all, bocked, removed)
1520 * @param string $order Order of the user list (Default is 'contact.name')
1521 * @param bool $descending Order direction (Default is ascending)
1523 * @return array The list of the users
1526 public static function getList($start = 0, $count = Pager::ITEMS_PER_PAGE, $type = 'all', $order = 'name', bool $descending = false)
1528 $param = ['limit' => [$start, $count], 'order' => [$order => $descending]];
1532 $condition['account_removed'] = false;
1533 $condition['blocked'] = false;
1536 $condition['account_removed'] = false;
1537 $condition['blocked'] = true;
1538 $condition['verified'] = true;
1541 $condition['account_removed'] = true;
1545 return DBA::selectToArray('owner-view', [], $condition, $param);