3 * @copyright Copyright (C) 2010-2023, the Friendica project
5 * @license GNU AGPL version 3 or any later version
7 * This program is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU Affero General Public License as
9 * published by the Free Software Foundation, either version 3 of the
10 * License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Affero General Public License for more details.
17 * You should have received a copy of the GNU Affero General Public License
18 * along with this program. If not, see <https://www.gnu.org/licenses/>.
22 namespace Friendica\Model;
24 use DivineOmega\DOFileCachePSR6\CacheItemPool;
25 use DivineOmega\PasswordExposed;
28 use Friendica\Content\Pager;
29 use Friendica\Core\Hook;
30 use Friendica\Core\L10n;
31 use Friendica\Core\Logger;
32 use Friendica\Core\Protocol;
33 use Friendica\Core\Search;
34 use Friendica\Core\System;
35 use Friendica\Core\Worker;
36 use Friendica\Database\DBA;
39 use Friendica\Network\HTTPClient\Client\HttpClientAccept;
40 use Friendica\Network\HTTPException\InternalServerErrorException;
41 use Friendica\Security\TwoFactor\Model\AppSpecificPassword;
42 use Friendica\Network\HTTPException;
43 use Friendica\Object\Image;
44 use Friendica\Protocol\Delivery;
45 use Friendica\Util\Crypto;
46 use Friendica\Util\DateTimeFormat;
47 use Friendica\Util\Images;
48 use Friendica\Util\Network;
49 use Friendica\Util\Proxy;
50 use Friendica\Util\Strings;
55 * This class handles User related functions
62 * PAGE_FLAGS_NORMAL is a typical personal profile account
63 * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
64 * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
65 * write access to wall and comments (no email and not included in page owner's ACL lists)
66 * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
70 const PAGE_FLAGS_NORMAL = 0;
71 const PAGE_FLAGS_SOAPBOX = 1;
72 const PAGE_FLAGS_COMMUNITY = 2;
73 const PAGE_FLAGS_FREELOVE = 3;
74 const PAGE_FLAGS_BLOG = 4;
75 const PAGE_FLAGS_PRVGROUP = 5;
83 * ACCOUNT_TYPE_PERSON - the account belongs to a person
84 * Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
86 * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
87 * Associated page type: PAGE_FLAGS_SOAPBOX
89 * ACCOUNT_TYPE_NEWS - the account is a news reflector
90 * Associated page type: PAGE_FLAGS_SOAPBOX
92 * ACCOUNT_TYPE_COMMUNITY - the account is community group
93 * Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
95 * ACCOUNT_TYPE_RELAY - the account is a relay
96 * This will only be assigned to contacts, not to user accounts
99 const ACCOUNT_TYPE_PERSON = 0;
100 const ACCOUNT_TYPE_ORGANISATION = 1;
101 const ACCOUNT_TYPE_NEWS = 2;
102 const ACCOUNT_TYPE_COMMUNITY = 3;
103 const ACCOUNT_TYPE_RELAY = 4;
104 const ACCOUNT_TYPE_DELETED = 127;
109 private static $owner;
112 * Returns the numeric account type by their string
114 * @param string $accounttype as string constant
115 * @return int|null Numeric account type - or null when not set
117 public static function getAccountTypeByString(string $accounttype)
119 switch ($accounttype) {
121 return User::ACCOUNT_TYPE_PERSON;
124 return User::ACCOUNT_TYPE_ORGANISATION;
127 return User::ACCOUNT_TYPE_NEWS;
130 return User::ACCOUNT_TYPE_COMMUNITY;
137 * Get the Uri-Id of the system account
141 public static function getSystemUriId(): int
143 $system = self::getSystemAccount();
144 return $system['uri-id'] ?? 0;
148 * Fetch the system account
150 * @return array system account
152 public static function getSystemAccount(): array
154 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
155 if (!DBA::isResult($system)) {
156 self::createSystemAccount();
157 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
158 if (!DBA::isResult($system)) {
163 $system['sprvkey'] = $system['uprvkey'] = $system['prvkey'];
164 $system['spubkey'] = $system['upubkey'] = $system['pubkey'];
165 $system['nickname'] = $system['nick'];
166 $system['page-flags'] = User::PAGE_FLAGS_SOAPBOX;
167 $system['account-type'] = $system['contact-type'];
168 $system['guid'] = '';
169 $system['picdate'] = '';
170 $system['theme'] = '';
171 $system['publish'] = false;
172 $system['net-publish'] = false;
173 $system['hide-friends'] = true;
174 $system['hidewall'] = true;
175 $system['prv_keywords'] = '';
176 $system['pub_keywords'] = '';
177 $system['address'] = '';
178 $system['locality'] = '';
179 $system['region'] = '';
180 $system['postal-code'] = '';
181 $system['country-name'] = '';
182 $system['homepage'] = (string)DI::baseUrl();
183 $system['dob'] = '0000-00-00';
185 // Ensure that the user contains data
186 $user = DBA::selectFirst('user', ['prvkey', 'guid', 'language'], ['uid' => 0]);
187 if (empty($user['prvkey']) || empty($user['guid'])) {
189 'username' => $system['name'],
190 'nickname' => $system['nick'],
191 'register_date' => $system['created'],
192 'pubkey' => $system['pubkey'],
193 'prvkey' => $system['prvkey'],
194 'spubkey' => $system['spubkey'],
195 'sprvkey' => $system['sprvkey'],
196 'guid' => System::createUUID(),
198 'page-flags' => User::PAGE_FLAGS_SOAPBOX,
199 'account-type' => User::ACCOUNT_TYPE_RELAY,
202 DBA::update('user', $fields, ['uid' => 0]);
204 $system['guid'] = $fields['guid'];
206 $system['guid'] = $user['guid'];
207 $system['language'] = $user['language'];
214 * Create the system account
218 private static function createSystemAccount()
220 $system_actor_name = self::getActorName();
221 if (empty($system_actor_name)) {
225 $keys = Crypto::newKeypair(4096);
226 if ($keys === false) {
227 throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
232 'created' => DateTimeFormat::utcNow(),
234 'network' => Protocol::ACTIVITYPUB,
235 'name' => 'System Account',
236 'addr' => $system_actor_name . '@' . DI::baseUrl()->getHost(),
237 'nick' => $system_actor_name,
238 'url' => DI::baseUrl() . '/friendica',
239 'pubkey' => $keys['pubkey'],
240 'prvkey' => $keys['prvkey'],
243 'contact-type' => Contact::TYPE_RELAY, // In AP this is translated to 'Application'
244 'name-date' => DateTimeFormat::utcNow(),
245 'uri-date' => DateTimeFormat::utcNow(),
246 'avatar-date' => DateTimeFormat::utcNow(),
248 'baseurl' => DI::baseUrl(),
251 $system['avatar'] = $system['photo'] = Contact::getDefaultAvatar($system, Proxy::SIZE_SMALL);
252 $system['thumb'] = Contact::getDefaultAvatar($system, Proxy::SIZE_THUMB);
253 $system['micro'] = Contact::getDefaultAvatar($system, Proxy::SIZE_MICRO);
254 $system['nurl'] = Strings::normaliseLink($system['url']);
255 $system['gsid'] = GServer::getID($system['baseurl']);
257 Contact::insert($system);
261 * Detect a usable actor name
263 * @return string actor account name
265 public static function getActorName(): string
267 $system_actor_name = DI::config()->get('system', 'actor_name');
268 if (!empty($system_actor_name)) {
269 $self = Contact::selectFirst(['nick'], ['uid' => 0, 'self' => true]);
270 if (!empty($self['nick'])) {
271 if ($self['nick'] != $system_actor_name) {
272 // Reset the actor name to the already used name
273 DI::config()->set('system', 'actor_name', $self['nick']);
274 $system_actor_name = $self['nick'];
277 return $system_actor_name;
280 // List of possible actor names
281 $possible_accounts = ['friendica', 'actor', 'system', 'internal'];
282 foreach ($possible_accounts as $name) {
283 if (!DBA::exists('user', ['nickname' => $name, 'account_removed' => false, 'account_expired' => false]) &&
284 !DBA::exists('userd', ['username' => $name])) {
285 DI::config()->set('system', 'actor_name', $name);
293 * Returns true if a user record exists with the provided id
300 public static function exists(int $uid): bool
302 return DBA::exists('user', ['uid' => $uid]);
306 * @param integer $uid
307 * @param array $fields
308 * @return array|boolean User record if it exists, false otherwise
311 public static function getById(int $uid, array $fields = [])
313 return !empty($uid) ? DBA::selectFirst('user', $fields, ['uid' => $uid]) : [];
317 * Returns a user record based on it's GUID
319 * @param string $guid The guid of the user
320 * @param array $fields The fields to retrieve
321 * @param bool $active True, if only active records are searched
323 * @return array|boolean User record if it exists, false otherwise
326 public static function getByGuid(string $guid, array $fields = [], bool $active = true)
329 $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
331 $cond = ['guid' => $guid];
334 return DBA::selectFirst('user', $fields, $cond);
338 * @param string $nickname
339 * @param array $fields
340 * @return array|boolean User record if it exists, false otherwise
343 public static function getByNickname(string $nickname, array $fields = [])
345 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
349 * Returns the user id of a given profile URL
353 * @return integer user id
356 public static function getIdForURL(string $url): int
358 // Avoid database queries when the local node hostname isn't even part of the url.
359 if (!Contact::isLocal($url)) {
363 $self = Contact::selectFirst(['uid'], ['self' => true, 'nurl' => Strings::normaliseLink($url)]);
364 if (!empty($self['uid'])) {
368 $self = Contact::selectFirst(['uid'], ['self' => true, 'addr' => $url]);
369 if (!empty($self['uid'])) {
373 $self = Contact::selectFirst(['uid'], ['self' => true, 'alias' => [$url, Strings::normaliseLink($url)]]);
374 if (!empty($self['uid'])) {
382 * Get a user based on its email
384 * @param string $email
385 * @param array $fields
386 * @return array|boolean User record if it exists, false otherwise
389 public static function getByEmail(string $email, array $fields = [])
391 return DBA::selectFirst('user', $fields, ['email' => $email]);
395 * Fetch the user array of the administrator. The first one if there are several.
397 * @param array $fields
401 public static function getFirstAdmin(array $fields = []) : array
403 if (!empty(DI::config()->get('config', 'admin_nickname'))) {
404 return self::getByNickname(DI::config()->get('config', 'admin_nickname'), $fields);
407 return self::getAdminList()[0] ?? [];
411 * Get owner data by user id
414 * @param boolean $repairMissing Repair the owner data if it's missing
415 * @return boolean|array
418 public static function getOwnerDataById(int $uid, bool $repairMissing = true)
421 return self::getSystemAccount();
424 if (!empty(self::$owner[$uid])) {
425 return self::$owner[$uid];
428 $owner = DBA::selectFirst('owner-view', [], ['uid' => $uid]);
429 if (!DBA::isResult($owner)) {
430 if (!self::exists($uid) || !$repairMissing) {
433 if (!DBA::exists('profile', ['uid' => $uid])) {
434 DBA::insert('profile', ['uid' => $uid]);
436 if (!DBA::exists('contact', ['uid' => $uid, 'self' => true])) {
437 Contact::createSelfFromUserId($uid);
439 $owner = self::getOwnerDataById($uid, false);
442 if (empty($owner['nickname'])) {
446 if (!$repairMissing || $owner['account_expired']) {
450 // Check if the returned data is valid, otherwise fix it. See issue #6122
452 // Check for correct url and normalised nurl
453 $url = DI::baseUrl() . '/profile/' . $owner['nickname'];
454 $repair = empty($owner['network']) || ($owner['url'] != $url) || ($owner['nurl'] != Strings::normaliseLink($owner['url']));
457 // Check if "addr" is present and correct
458 $addr = $owner['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
459 $repair = ($addr != $owner['addr']) || empty($owner['prvkey']) || empty($owner['pubkey']);
463 // Check if the avatar field is filled and the photo directs to the correct path
464 $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
465 if (DBA::isResult($avatar)) {
466 $repair = empty($owner['avatar']) || !strpos($owner['photo'], $avatar['resource-id']);
471 Contact::updateSelfFromUserID($uid);
472 // Return the corrected data and avoid a loop
473 $owner = self::getOwnerDataById($uid, false);
476 self::$owner[$uid] = $owner;
481 * Get owner data by nick name
484 * @return boolean|array
487 public static function getOwnerDataByNick(string $nick)
489 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
491 if (!DBA::isResult($user)) {
495 return self::getOwnerDataById($user['uid']);
499 * Returns the default circle for a given user
501 * @param int $uid User id
503 * @return int circle id
506 public static function getDefaultCircle(int $uid): int
508 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
509 if (DBA::isResult($user)) {
510 $default_circle = $user['def_gid'];
515 return $default_circle;
519 * Returns the default circle for groups for a given user
521 * @param int $uid User id
523 * @return int circle id
526 public static function getDefaultGroupCircle(int $uid): int
528 $default_circle = DI::pConfig()->get($uid, 'system', 'default-group-gid');
529 if (empty($default_circle)) {
530 $default_circle = self::getDefaultCircle($uid);
533 return $default_circle;
537 * Fetch the language code from the given user. If the code is invalid, return the system language
539 * @param integer $uid User-Id
540 * @param boolean $short If true, return the short form g.g. "en", otherwise the long form e.g. "en-gb"
543 public static function getLanguageCode(int $uid, bool $short): string
545 $owner = self::getOwnerDataById($uid);
546 $languages = DI::l10n()->getAvailableLanguages();
547 if (in_array($owner['language'], array_keys($languages))) {
548 $language = $owner['language'];
550 $language = DI::config()->get('system', 'language');
553 return substr($language, 0, 2);
559 * Authenticate a user with a clear text password
561 * Returns the user id associated with a successful password authentication
563 * @param mixed $user_info
564 * @param string $password
565 * @param bool $third_party
566 * @return int User Id if authentication is successful
567 * @throws HTTPException\ForbiddenException
568 * @throws HTTPException\NotFoundException
570 public static function getIdFromPasswordAuthentication($user_info, string $password, bool $third_party = false): int
572 // Addons registered with the "authenticate" hook may create the user on the
573 // fly. `getAuthenticationInfo` will fail if the user doesn't exist yet. If
574 // the user doesn't exist, we should give the addons a chance to create the
575 // user in our database, if applicable, before re-throwing the exception if
578 $user = self::getAuthenticationInfo($user_info);
579 } catch (Exception $e) {
580 $username = (is_string($user_info) ? $user_info : $user_info['nickname'] ?? '');
582 // Addons can create users, and since this 'catch' branch should only
583 // execute if getAuthenticationInfo can't find an existing user, that's
584 // exactly what will happen here. Creating a numeric username would create
585 // ambiguity with user IDs, possibly opening up an attack vector.
586 // So let's be very careful about that.
587 if (empty($username) || is_numeric($username)) {
591 return self::getIdFromAuthenticateHooks($username, $password);
594 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
595 // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
596 if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
599 } elseif (strpos($user['password'], '$') === false) {
600 //Legacy hash that has not been replaced by a new hash yet
601 if (self::hashPasswordLegacy($password) === $user['password']) {
602 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
606 } elseif (!empty($user['legacy_password'])) {
607 //Legacy hash that has been double-hashed and not replaced by a new hash yet
608 //Warning: `legacy_password` is not necessary in sync with the content of `password`
609 if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
610 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
614 } elseif (password_verify($password, $user['password'])) {
616 if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
617 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
622 return self::getIdFromAuthenticateHooks($user['nickname'], $password); // throws
625 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
629 * Try to obtain a user ID via "authenticate" hook addons
631 * Returns the user id associated with a successful password authentication
633 * @param string $username
634 * @param string $password
635 * @return int User Id if authentication is successful
636 * @throws HTTPException\ForbiddenException
638 public static function getIdFromAuthenticateHooks(string $username, string $password): int
641 'username' => $username,
642 'password' => $password,
643 'authenticated' => 0,
644 'user_record' => null
648 * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
649 * Addons should never set 'authenticated' except to indicate success - as hooks may be chained
650 * and later addons should not interfere with an earlier one that succeeded.
652 Hook::callAll('authenticate', $addon_auth);
654 if ($addon_auth['authenticated'] && $addon_auth['user_record']) {
655 return $addon_auth['user_record']['uid'];
658 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
662 * Returns authentication info from various parameters types
664 * User info can be any of the following:
667 * - User email or username or nickname
668 * - User array with at least the uid and the hashed password
670 * @param mixed $user_info
671 * @return array|null Null if not found/determined
672 * @throws HTTPException\NotFoundException
674 public static function getAuthenticationInfo($user_info)
678 if (is_object($user_info) || is_array($user_info)) {
679 if (is_object($user_info)) {
680 $user = (array) $user_info;
687 || !isset($user['password'])
688 || !isset($user['legacy_password'])
690 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
692 } elseif (is_int($user_info) || is_string($user_info)) {
693 if (is_int($user_info)) {
694 $user = DBA::selectFirst(
696 ['uid', 'nickname', 'password', 'legacy_password'],
700 'account_expired' => 0,
701 'account_removed' => 0,
706 $fields = ['uid', 'nickname', 'password', 'legacy_password'];
708 "(`email` = ? OR `username` = ? OR `nickname` = ?)
709 AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
710 $user_info, $user_info, $user_info
712 $user = DBA::selectFirst('user', $fields, $condition);
715 if (!DBA::isResult($user)) {
716 throw new HTTPException\NotFoundException(DI::l10n()->t('User not found'));
724 * Update the day of the last activity of the given user
726 * @param integer $uid
729 public static function updateLastActivity(int $uid)
735 $user = User::getById($uid, ['last-activity']);
740 $current_day = DateTimeFormat::utcNow('Y-m-d');
742 if ($user['last-activity'] != $current_day) {
743 User::update(['last-activity' => $current_day], $uid);
744 // Set the last activity for all identities of the user
745 DBA::update('user', ['last-activity' => $current_day], ['parent-uid' => $uid, 'account_removed' => false]);
750 * Generates a human-readable random password
755 public static function generateNewPassword(): string
757 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
761 * Checks if the provided plaintext password has been exposed or not
763 * @param string $password
767 public static function isPasswordExposed(string $password): bool
769 $cache = new CacheItemPool();
770 $cache->changeConfig([
771 'cacheDirectory' => System::getTempPath() . '/password-exposed-cache/',
775 $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
777 return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
778 } catch (Exception $e) {
779 Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
780 'code' => $e->getCode(),
781 'file' => $e->getFile(),
782 'line' => $e->getLine(),
783 'trace' => $e->getTraceAsString()
791 * Legacy hashing function, kept for password migration purposes
793 * @param string $password
796 private static function hashPasswordLegacy(string $password): string
798 return hash('whirlpool', $password);
802 * Global user password hashing function
804 * @param string $password
808 public static function hashPassword(string $password): string
810 if (!trim($password)) {
811 throw new Exception(DI::l10n()->t('Password can\'t be empty'));
814 return password_hash($password, PASSWORD_DEFAULT);
818 * Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces and accentuated letters.
820 * Password length is limited to 72 characters if the current default password hashing algorithm is Blowfish.
821 * From the manual: "Using the PASSWORD_BCRYPT as the algorithm, will result in the password parameter being
822 * truncated to a maximum length of 72 bytes."
824 * @see https://www.php.net/manual/en/function.password-hash.php#refsect1-function.password-hash-parameters
826 * @param string|null $delimiter Whether the regular expression is meant to be wrapper in delimiter characters
829 public static function getPasswordRegExp(string $delimiter = null): string
831 $allowed_characters = ':!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
834 $allowed_characters = preg_quote($allowed_characters, $delimiter);
837 return '^[a-zA-Z0-9' . $allowed_characters . ']' . (PASSWORD_DEFAULT === PASSWORD_BCRYPT ? '{1,72}' : '+') . '$';
841 * Updates a user row with a new plaintext password
844 * @param string $password
848 public static function updatePassword(int $uid, string $password): bool
850 $password = trim($password);
852 if (empty($password)) {
853 throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
856 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
857 throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
860 if (PASSWORD_DEFAULT === PASSWORD_BCRYPT && strlen($password) > 72) {
861 throw new Exception(DI::l10n()->t('The password length is limited to 72 characters.'));
864 if (!preg_match('/' . self::getPasswordRegExp('/') . '/', $password)) {
865 throw new Exception(DI::l10n()->t("The password can't contain white spaces nor accentuated letters"));
868 return self::updatePasswordHashed($uid, self::hashPassword($password));
872 * Updates a user row with a new hashed password.
873 * Empties the password reset token field just in case.
876 * @param string $password_hashed
880 private static function updatePasswordHashed(int $uid, string $password_hashed): bool
883 'password' => $password_hashed,
885 'pwdreset_time' => null,
886 'legacy_password' => false
888 return DBA::update('user', $fields, ['uid' => $uid]);
892 * Returns if the given uid is valid and in the admin list
899 public static function isSiteAdmin(int $uid): bool
901 return DBA::exists('user', [
903 'email' => self::getAdminEmailList()
908 * Returns if the given uid is valid and a moderator
915 public static function isModerator(int $uid): bool
917 // @todo Replace with a moderator check in the future
918 return self::isSiteAdmin($uid);
922 * Checks if a nickname is in the list of the forbidden nicknames
924 * Check if a nickname is forbidden from registration on the node by the
925 * admin. Forbidden nicknames (e.g. role names) can be configured in the
928 * @param string $nickname The nickname that should be checked
929 * @return boolean True is the nickname is blocked on the node
931 public static function isNicknameBlocked(string $nickname): bool
933 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
934 if (!empty($forbidden_nicknames)) {
935 $forbidden = explode(',', $forbidden_nicknames);
936 $forbidden = array_map('trim', $forbidden);
941 // Add the name of the internal actor to the "forbidden" list
942 $actor_name = self::getActorName();
943 if (!empty($actor_name)) {
944 $forbidden[] = $actor_name;
947 if (empty($forbidden)) {
951 // check if the nickname is in the list of blocked nicknames
952 if (in_array(strtolower($nickname), $forbidden)) {
961 * Get avatar link for given user
964 * @param string $size One of the Proxy::SIZE_* constants
965 * @return string avatar link
968 public static function getAvatarUrl(array $user, string $size = ''): string
970 if (empty($user['nickname'])) {
971 DI::logger()->warning('Missing user nickname key', ['trace' => System::callstack(20)]);
974 $url = DI::baseUrl() . '/photo/';
977 case Proxy::SIZE_MICRO:
981 case Proxy::SIZE_THUMB:
994 $photo = Photo::selectFirst(['type', 'created', 'edited', 'updated'], ["scale" => $scale, 'uid' => $user['uid'], 'profile' => true]);
995 if (!empty($photo)) {
996 $updated = max($photo['created'], $photo['edited'], $photo['updated']);
997 $mimetype = $photo['type'];
1000 return $url . $user['nickname'] . Images::getExtensionByMimeType($mimetype) . ($updated ? '?ts=' . strtotime($updated) : '');
1004 * Get banner link for given user
1006 * @param array $user
1007 * @return string banner link
1010 public static function getBannerUrl(array $user): string
1012 if (empty($user['nickname'])) {
1013 DI::logger()->warning('Missing user nickname key', ['trace' => System::callstack(20)]);
1016 $url = DI::baseUrl() . '/photo/banner/';
1021 $photo = Photo::selectFirst(['type', 'created', 'edited', 'updated'], ["scale" => 3, 'uid' => $user['uid'], 'photo-type' => Photo::USER_BANNER]);
1022 if (!empty($photo)) {
1023 $updated = max($photo['created'], $photo['edited'], $photo['updated']);
1024 $mimetype = $photo['type'];
1026 // Only for the RC phase: Don't return an image link for the default picture
1030 return $url . $user['nickname'] . Images::getExtensionByMimeType($mimetype) . ($updated ? '?ts=' . strtotime($updated) : '');
1034 * Catch-all user creation function
1036 * Creates a user from the provided data array, either form fields or OpenID.
1037 * Required: { username, nickname, email } or { openid_url }
1039 * Performs the following:
1040 * - Sends to the OpenId auth URL (if relevant)
1041 * - Creates new key pairs for crypto
1042 * - Create self-contact
1043 * - Create profile image
1045 * @param array $data
1047 * @throws ErrorException
1048 * @throws HTTPException\InternalServerErrorException
1049 * @throws ImagickException
1052 public static function create(array $data): array
1054 $return = ['user' => null, 'password' => ''];
1056 $using_invites = DI::config()->get('system', 'invitation_only');
1058 $invite_id = !empty($data['invite_id']) ? trim($data['invite_id']) : '';
1059 $username = !empty($data['username']) ? trim($data['username']) : '';
1060 $nickname = !empty($data['nickname']) ? trim($data['nickname']) : '';
1061 $email = !empty($data['email']) ? trim($data['email']) : '';
1062 $openid_url = !empty($data['openid_url']) ? trim($data['openid_url']) : '';
1063 $photo = !empty($data['photo']) ? trim($data['photo']) : '';
1064 $password = !empty($data['password']) ? trim($data['password']) : '';
1065 $password1 = !empty($data['password1']) ? trim($data['password1']) : '';
1066 $confirm = !empty($data['confirm']) ? trim($data['confirm']) : '';
1067 $blocked = !empty($data['blocked']);
1068 $verified = !empty($data['verified']);
1069 $language = !empty($data['language']) ? trim($data['language']) : 'en';
1071 $netpublish = $publish = !empty($data['profile_publish_reg']);
1073 if ($password1 != $confirm) {
1074 throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
1075 } elseif ($password1 != '') {
1076 $password = $password1;
1079 if ($using_invites) {
1081 throw new Exception(DI::l10n()->t('An invitation is required.'));
1084 if (!Register::existsByHash($invite_id)) {
1085 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
1089 /// @todo Check if this part is really needed. We should have fetched all this data in advance
1090 if (empty($username) || empty($email) || empty($nickname)) {
1092 if (!Network::isUrlValid($openid_url)) {
1093 throw new Exception(DI::l10n()->t('Invalid OpenID url'));
1095 $_SESSION['register'] = 1;
1096 $_SESSION['openid'] = $openid_url;
1098 $openid = new LightOpenID(DI::baseUrl()->getHost());
1099 $openid->identity = $openid_url;
1100 $openid->returnUrl = DI::baseUrl() . '/openid';
1101 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
1102 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
1104 $authurl = $openid->authUrl();
1105 } catch (Exception $e) {
1106 throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . '<br />' . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
1108 System::externalRedirect($authurl);
1112 throw new Exception(DI::l10n()->t('Please enter the required information.'));
1115 if (!Network::isUrlValid($openid_url)) {
1119 // collapse multiple spaces in name
1120 $username = preg_replace('/ +/', ' ', $username);
1122 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
1123 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
1125 if ($username_min_length > $username_max_length) {
1126 Logger::error(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length));
1127 $tmp = $username_min_length;
1128 $username_min_length = $username_max_length;
1129 $username_max_length = $tmp;
1132 if (mb_strlen($username) < $username_min_length) {
1133 throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
1136 if (mb_strlen($username) > $username_max_length) {
1137 throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
1140 // So now we are just looking for a space in the full name.
1141 $loose_reg = DI::config()->get('system', 'no_regfullname');
1143 $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
1144 if (strpos($username, ' ') === false) {
1145 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
1149 if (!Network::isEmailDomainAllowed($email)) {
1150 throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
1153 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
1154 throw new Exception(DI::l10n()->t('Not a valid email address.'));
1156 if (self::isNicknameBlocked($nickname)) {
1157 throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
1160 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
1161 throw new Exception(DI::l10n()->t('Cannot use that email.'));
1164 // Disallow somebody creating an account using openid that uses the admin email address,
1165 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
1166 if (strlen($openid_url) && in_array(strtolower($email), self::getAdminEmailList())) {
1167 throw new Exception(DI::l10n()->t('Cannot use that email.'));
1170 $nickname = $data['nickname'] = strtolower($nickname);
1172 if (!preg_match('/^[a-z0-9][a-z0-9_]*$/', $nickname)) {
1173 throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
1176 // Check existing and deleted accounts for this nickname.
1178 DBA::exists('user', ['nickname' => $nickname])
1179 || DBA::exists('userd', ['username' => $nickname])
1181 throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
1184 $new_password = strlen($password) ? $password : User::generateNewPassword();
1185 $new_password_encoded = self::hashPassword($new_password);
1187 $return['password'] = $new_password;
1189 $keys = Crypto::newKeypair(4096);
1190 if ($keys === false) {
1191 throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
1194 $prvkey = $keys['prvkey'];
1195 $pubkey = $keys['pubkey'];
1197 // Create another keypair for signing/verifying salmon protocol messages.
1198 $sres = Crypto::newKeypair(512);
1199 $sprvkey = $sres['prvkey'];
1200 $spubkey = $sres['pubkey'];
1202 $insert_result = DBA::insert('user', [
1203 'guid' => System::createUUID(),
1204 'username' => $username,
1205 'password' => $new_password_encoded,
1207 'openid' => $openid_url,
1208 'nickname' => $nickname,
1209 'pubkey' => $pubkey,
1210 'prvkey' => $prvkey,
1211 'spubkey' => $spubkey,
1212 'sprvkey' => $sprvkey,
1213 'verified' => $verified,
1214 'blocked' => $blocked,
1215 'language' => $language,
1216 'timezone' => 'UTC',
1217 'register_date' => DateTimeFormat::utcNow(),
1218 'default-location' => ''
1221 if ($insert_result) {
1222 $uid = DBA::lastInsertId();
1223 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1225 throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1229 throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1232 // if somebody clicked submit twice very quickly, they could end up with two accounts
1233 // due to race condition. Remove this one.
1234 $user_count = DBA::count('user', ['nickname' => $nickname]);
1235 if ($user_count > 1) {
1236 DBA::delete('user', ['uid' => $uid]);
1238 throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
1241 $insert_result = DBA::insert('profile', [
1243 'name' => $username,
1244 'photo' => self::getAvatarUrl($user),
1245 'thumb' => self::getAvatarUrl($user, Proxy::SIZE_THUMB),
1246 'publish' => $publish,
1247 'net-publish' => $netpublish,
1249 if (!$insert_result) {
1250 DBA::delete('user', ['uid' => $uid]);
1252 throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
1255 // Create the self contact
1256 if (!Contact::createSelfFromUserId($uid)) {
1257 DBA::delete('user', ['uid' => $uid]);
1259 throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
1262 // Create a circle with no members. This allows somebody to use it
1263 // right away as a default circle for new contacts.
1264 $def_gid = Circle::create($uid, DI::l10n()->t('Friends'));
1266 DBA::delete('user', ['uid' => $uid]);
1268 throw new Exception(DI::l10n()->t('An error occurred creating your default contact circle. Please try again.'));
1271 $fields = ['def_gid' => $def_gid];
1272 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
1273 $fields['allow_gid'] = '<' . $def_gid . '>';
1276 DBA::update('user', $fields, ['uid' => $uid]);
1278 $def_gid_groups = Circle::create($uid, DI::l10n()->t('Groups'));
1279 if ($def_gid_groups) {
1280 DI::pConfig()->set($uid, 'system', 'default-group-gid', $def_gid_groups);
1283 // if we have no OpenID photo try to look up an avatar
1284 if (!strlen($photo)) {
1285 $photo = Network::lookupAvatarByEmail($email);
1288 // unless there is no avatar-addon loaded
1289 if (strlen($photo)) {
1290 $photo_failure = false;
1292 $filename = basename($photo);
1293 $curlResult = DI::httpClient()->get($photo, HttpClientAccept::IMAGE);
1294 if ($curlResult->isSuccess()) {
1295 Logger::debug('Got picture', ['Content-Type' => $curlResult->getHeader('Content-Type'), 'url' => $photo]);
1296 $img_str = $curlResult->getBody();
1297 $type = $curlResult->getContentType();
1303 $type = Images::getMimeTypeByData($img_str, $photo, $type);
1305 $image = new Image($img_str, $type);
1306 if ($image->isValid()) {
1307 $image->scaleToSquare(300);
1309 $resource_id = Photo::newResource();
1311 // Not using Photo::PROFILE_PHOTOS here, so that it is discovered as translatable string
1312 $profile_album = DI::l10n()->t('Profile Photos');
1314 $r = Photo::store($image, $uid, 0, $resource_id, $filename, $profile_album, 4);
1317 $photo_failure = true;
1320 $image->scaleDown(80);
1322 $r = Photo::store($image, $uid, 0, $resource_id, $filename, $profile_album, 5);
1325 $photo_failure = true;
1328 $image->scaleDown(48);
1330 $r = Photo::store($image, $uid, 0, $resource_id, $filename, $profile_album, 6);
1333 $photo_failure = true;
1336 if (!$photo_failure) {
1337 Photo::update(['profile' => true, 'photo-type' => Photo::USER_AVATAR], ['resource-id' => $resource_id]);
1341 Contact::updateSelfFromUserID($uid, true);
1344 Hook::callAll('register_account', $uid);
1346 self::setRegisterMethodByUserCount();
1348 $return['user'] = $user;
1353 * Update a user entry and distribute the changes if needed
1355 * @param array $fields
1356 * @param integer $uid
1360 public static function update(array $fields, int $uid): bool
1362 if (!DBA::update('user', $fields, ['uid' => $uid])) {
1366 if (Contact::updateSelfFromUserID($uid)) {
1367 Profile::publishUpdate($uid);
1374 * Sets block state for a given user
1376 * @param int $uid The user id
1377 * @param bool $block Block state (default is true)
1379 * @return bool True, if successfully blocked
1383 public static function block(int $uid, bool $block = true): bool
1385 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
1389 * Allows a registration based on a hash
1391 * @param string $hash
1393 * @return bool True, if the allow was successful
1395 * @throws HTTPException\InternalServerErrorException
1398 public static function allow(string $hash): bool
1400 $register = Register::getByHash($hash);
1401 if (!DBA::isResult($register)) {
1405 $user = User::getById($register['uid']);
1406 if (!DBA::isResult($user)) {
1410 Register::deleteByHash($hash);
1412 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
1414 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
1416 if (DBA::isResult($profile) && $profile['net-publish'] && Search::getGlobalDirectory()) {
1417 $url = DI::baseUrl() . '/profile/' . $user['nickname'];
1418 Worker::add(Worker::PRIORITY_LOW, "Directory", $url);
1421 $l10n = DI::l10n()->withLang($register['language']);
1423 return User::sendRegisterOpenEmail(
1426 DI::config()->get('config', 'sitename'),
1428 ($register['password'] ?? '') ?: 'Sent in a previous email'
1433 * Denys a pending registration
1435 * @param string $hash The hash of the pending user
1437 * This does not have to go through user_remove() and save the nickname
1438 * permanently against re-registration, as the person was not yet
1439 * allowed to have friends on this system
1441 * @return bool True, if the deny was successful
1444 public static function deny(string $hash): bool
1446 $register = Register::getByHash($hash);
1447 if (!DBA::isResult($register)) {
1451 $user = User::getById($register['uid']);
1452 if (!DBA::isResult($user)) {
1456 // Delete the avatar
1457 Photo::delete(['uid' => $register['uid']]);
1459 return DBA::delete('user', ['uid' => $register['uid']]) &&
1460 Register::deleteByHash($register['hash']);
1464 * Creates a new user based on a minimal set and sends an email to this user
1466 * @param string $name The user's name
1467 * @param string $email The user's email address
1468 * @param string $nick The user's nick name
1469 * @param string $lang The user's language (default is english)
1470 * @return bool True, if the user was created successfully
1471 * @throws HTTPException\InternalServerErrorException
1472 * @throws ErrorException
1473 * @throws ImagickException
1475 public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT): bool
1480 throw new HTTPException\InternalServerErrorException('Invalid arguments.');
1483 $result = self::create([
1484 'username' => $name,
1486 'nickname' => $nick,
1491 $user = $result['user'];
1492 $preamble = Strings::deindent(DI::l10n()->t('
1494 the administrator of %2$s has set up an account for you.'));
1495 $body = Strings::deindent(DI::l10n()->t('
1496 The login details are as follows:
1502 You may change your password from your account "Settings" page after logging
1505 Please take a few moments to review the other account settings on that page.
1507 You may also wish to add some basic information to your default profile
1508 (on the "Profiles" page) so that other people can easily find you.
1510 We recommend setting your full name, adding a profile photo,
1511 adding some profile "keywords" (very useful in making new friends) - and
1512 perhaps what country you live in; if you do not wish to be more specific
1515 We fully respect your right to privacy, and none of these items are necessary.
1516 If you are new and do not know anybody here, they may help
1517 you to make some new and interesting friends.
1519 If you ever want to delete your account, you can do so at %1$s/settings/removeme
1521 Thank you and welcome to %4$s.'));
1523 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1524 $body = sprintf($body, DI::baseUrl(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1526 $email = DI::emailer()
1528 ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1530 ->withRecipient($user['email'])
1532 return DI::emailer()->send($email);
1536 * Sends pending registration confirmation email
1538 * @param array $user User record array
1539 * @param string $sitename
1540 * @param string $siteurl
1541 * @param string $password Plaintext password
1542 * @return NULL|boolean from notification() and email() inherited
1543 * @throws HTTPException\InternalServerErrorException
1545 public static function sendRegisterPendingEmail(array $user, string $sitename, string $siteurl, string $password)
1547 $body = Strings::deindent(DI::l10n()->t(
1550 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1552 Your login details are as follows:
1565 $email = DI::emailer()
1567 ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1569 ->withRecipient($user['email'])
1571 return DI::emailer()->send($email);
1575 * Sends registration confirmation
1577 * It's here as a function because the mail is sent from different parts
1579 * @param L10n $l10n The used language
1580 * @param array $user User record array
1581 * @param string $sitename
1582 * @param string $siteurl
1583 * @param string $password Plaintext password
1585 * @return NULL|boolean from notification() and email() inherited
1586 * @throws HTTPException\InternalServerErrorException
1588 public static function sendRegisterOpenEmail(L10n $l10n, array $user, string $sitename, string $siteurl, string $password)
1590 $preamble = Strings::deindent($l10n->t(
1593 Thank you for registering at %2$s. Your account has been created.
1598 $body = Strings::deindent($l10n->t(
1600 The login details are as follows:
1606 You may change your password from your account "Settings" page after logging
1609 Please take a few moments to review the other account settings on that page.
1611 You may also wish to add some basic information to your default profile
1612 ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1614 We recommend setting your full name, adding a profile photo,
1615 adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1616 perhaps what country you live in; if you do not wish to be more specific
1619 We fully respect your right to privacy, and none of these items are necessary.
1620 If you are new and do not know anybody here, they may help
1621 you to make some new and interesting friends.
1623 If you ever want to delete your account, you can do so at %3$s/settings/removeme
1625 Thank you and welcome to %2$s.',
1633 $email = DI::emailer()
1635 ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1637 ->withRecipient($user['email'])
1639 return DI::emailer()->send($email);
1643 * @param int $uid user to remove
1645 * @throws HTTPException\InternalServerErrorException
1647 public static function remove(int $uid): bool
1653 Logger::notice('Removing user', ['user' => $uid]);
1655 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1657 Hook::callAll('remove_user', $user);
1659 // save username (actually the nickname as it is guaranteed
1660 // unique), so it cannot be re-registered in the future.
1661 DBA::insert('userd', ['username' => $user['nickname']]);
1663 // Remove all personal settings, especially connector settings
1664 DBA::delete('pconfig', ['uid' => $uid]);
1666 // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
1667 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1668 Worker::add(Worker::PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1670 // Send an update to the directory
1671 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1672 Worker::add(Worker::PRIORITY_LOW, 'Directory', $self['url']);
1674 // Remove the user relevant data
1675 Worker::add(Worker::PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1677 self::setRegisterMethodByUserCount();
1682 * Return all identities to a user
1684 * @param int $uid The user id
1685 * @return array All identities for this user
1687 * Example for a return:
1691 * 'username' => 'maxmuster',
1692 * 'nickname' => 'Max Mustermann'
1696 * 'username' => 'johndoe',
1697 * 'nickname' => 'John Doe'
1702 public static function identities(int $uid): array
1710 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1711 if (!DBA::isResult($user)) {
1715 if (!$user['parent-uid']) {
1716 // First add our own entry
1718 'uid' => $user['uid'],
1719 'username' => $user['username'],
1720 'nickname' => $user['nickname']
1723 // Then add all the children
1726 ['uid', 'username', 'nickname'],
1727 ['parent-uid' => $user['uid'], 'account_removed' => false]
1729 if (DBA::isResult($r)) {
1730 $identities = array_merge($identities, DBA::toArray($r));
1733 // First entry is our parent
1736 ['uid', 'username', 'nickname'],
1737 ['uid' => $user['parent-uid'], 'account_removed' => false]
1739 if (DBA::isResult($r)) {
1740 $identities = DBA::toArray($r);
1743 // Then add all siblings
1746 ['uid', 'username', 'nickname'],
1747 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1749 if (DBA::isResult($r)) {
1750 $identities = array_merge($identities, DBA::toArray($r));
1755 "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1757 INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1758 WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1761 if (DBA::isResult($r)) {
1762 $identities = array_merge($identities, DBA::toArray($r));
1769 * Check if the given user id has delegations or is delegated
1774 public static function hasIdentities(int $uid): bool
1780 $user = DBA::selectFirst('user', ['parent-uid'], ['uid' => $uid, 'account_removed' => false]);
1781 if (!DBA::isResult($user)) {
1785 if ($user['parent-uid']) {
1789 if (DBA::exists('user', ['parent-uid' => $uid, 'account_removed' => false])) {
1793 if (DBA::exists('manage', ['uid' => $uid])) {
1801 * Returns statistical information about the current users of this node
1807 public static function getStatistics(): array
1811 'active_users_halfyear' => 0,
1812 'active_users_monthly' => 0,
1813 'active_users_weekly' => 0,
1816 $userStmt = DBA::select('owner-view', ['uid', 'last-activity', 'last-item'],
1817 ["`verified` AND `last-activity` > ? AND NOT `blocked`
1818 AND NOT `account_removed` AND NOT `account_expired`",
1819 DBA::NULL_DATETIME]);
1820 if (!DBA::isResult($userStmt)) {
1824 $halfyear = time() - (180 * 24 * 60 * 60);
1825 $month = time() - (30 * 24 * 60 * 60);
1826 $week = time() - (7 * 24 * 60 * 60);
1828 while ($user = DBA::fetch($userStmt)) {
1829 $statistics['total_users']++;
1831 if ((strtotime($user['last-activity']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1833 $statistics['active_users_halfyear']++;
1836 if ((strtotime($user['last-activity']) > $month) || (strtotime($user['last-item']) > $month)
1838 $statistics['active_users_monthly']++;
1841 if ((strtotime($user['last-activity']) > $week) || (strtotime($user['last-item']) > $week)
1843 $statistics['active_users_weekly']++;
1846 DBA::close($userStmt);
1852 * Get all users of the current node
1854 * @param int $start Start count (Default is 0)
1855 * @param int $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1856 * @param string $type The type of users, which should get (all, blocked, removed)
1857 * @param string $order Order of the user list (Default is 'contact.name')
1858 * @param bool $descending Order direction (Default is ascending)
1859 * @return array|bool The list of the users
1862 public static function getList(int $start = 0, int $count = Pager::ITEMS_PER_PAGE, string $type = 'all', string $order = 'name', bool $descending = false)
1864 $param = ['limit' => [$start, $count], 'order' => [$order => $descending]];
1868 $condition['account_removed'] = false;
1869 $condition['blocked'] = false;
1873 $condition['account_removed'] = false;
1874 $condition['blocked'] = true;
1875 $condition['verified'] = true;
1879 $condition['account_removed'] = true;
1883 return DBA::selectToArray('owner-view', [], $condition, $param);
1887 * Returns a list of lowercase admin email addresses from the comma-separated list in the config
1891 public static function getAdminEmailList(): array
1893 $adminEmails = strtolower(str_replace(' ', '', DI::config()->get('config', 'admin_email')));
1894 if (!$adminEmails) {
1898 return explode(',', $adminEmails);
1902 * Returns the complete list of admin user accounts
1904 * @param array $fields
1908 public static function getAdminList(array $fields = []): array
1911 'email' => self::getAdminEmailList(),
1912 'parent-uid' => null,
1915 'account_removed' => false,
1916 'account_expired' => false,
1919 return DBA::selectToArray('user', $fields, $condition, ['order' => ['uid']]);
1923 * Return a list of admin user accounts where each unique email address appears only once.
1925 * This method is meant for admin notifications that do not need to be sent multiple times to the same email address.
1927 * @param array $fields
1931 public static function getAdminListForEmailing(array $fields = []): array
1933 return array_filter(self::getAdminList($fields), function ($user) {
1934 static $emails = [];
1936 if (in_array($user['email'], $emails)) {
1940 $emails[] = $user['email'];
1946 public static function setRegisterMethodByUserCount()
1948 $max_registered_users = DI::config()->get('config', 'max_registered_users');
1949 if ($max_registered_users <= 0) {
1953 $register_policy = DI::config()->get('config', 'register_policy');
1954 if (!in_array($register_policy, [Module\Register::OPEN, Module\Register::CLOSED])) {
1955 Logger::debug('Unsupported register policy.', ['policy' => $register_policy]);
1959 $users = DBA::count('user', ['blocked' => false, 'account_removed' => false, 'account_expired' => false]);
1960 if (($users >= $max_registered_users) && ($register_policy == Module\Register::OPEN)) {
1961 DI::config()->set('config', 'register_policy', Module\Register::CLOSED);
1962 Logger::notice('Max users reached, registration is closed.', ['users' => $users, 'max' => $max_registered_users]);
1963 } elseif (($users < $max_registered_users) && ($register_policy == Module\Register::CLOSED)) {
1964 DI::config()->set('config', 'register_policy', Module\Register::OPEN);
1965 Logger::notice('Below maximum users, registration is opened.', ['users' => $users, 'max' => $max_registered_users]);
1967 Logger::debug('Unchanged register policy', ['policy' => $register_policy, 'users' => $users, 'max' => $max_registered_users]);