src/Model/User.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2021, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Model;
  23
  24 use DivineOmega\DOFileCachePSR6\CacheItemPool;
  25 use DivineOmega\PasswordExposed;
  26 use ErrorException;
  27 use Exception;
  28 use Friendica\Content\Pager;
  29 use Friendica\Core\Hook;
  30 use Friendica\Core\L10n;
  31 use Friendica\Core\Logger;
  32 use Friendica\Core\Protocol;
  33 use Friendica\Core\System;
  34 use Friendica\Core\Worker;
  35 use Friendica\Database\DBA;
  36 use Friendica\DI;
  37 use Friendica\Security\TwoFactor\Model\AppSpecificPassword;
  38 use Friendica\Network\HTTPException;
  39 use Friendica\Object\Image;
  40 use Friendica\Util\Crypto;
  41 use Friendica\Util\DateTimeFormat;
  42 use Friendica\Util\Images;
  43 use Friendica\Util\Network;
  44 use Friendica\Util\Proxy;
  45 use Friendica\Util\Strings;
  46 use Friendica\Worker\Delivery;
  47 use ImagickException;
  48 use LightOpenID;
  49
  50 /**
  51  * This class handles User related functions
  52  */
  53 class User
  54 {
  55         /**
  56          * Page/profile types
  57          *
  58          * PAGE_FLAGS_NORMAL is a typical personal profile account
  59          * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
  60          * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
  61          *      write access to wall and comments (no email and not included in page owner's ACL lists)
  62          * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
  63          *
  64          * @{
  65          */
  66         const PAGE_FLAGS_NORMAL    = 0;
  67         const PAGE_FLAGS_SOAPBOX   = 1;
  68         const PAGE_FLAGS_COMMUNITY = 2;
  69         const PAGE_FLAGS_FREELOVE  = 3;
  70         const PAGE_FLAGS_BLOG      = 4;
  71         const PAGE_FLAGS_PRVGROUP  = 5;
  72         /**
  73          * @}
  74          */
  75
  76         /**
  77          * Account types
  78          *
  79          * ACCOUNT_TYPE_PERSON - the account belongs to a person
  80          *      Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
  81          *
  82          * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
  83          *      Associated page type: PAGE_FLAGS_SOAPBOX
  84          *
  85          * ACCOUNT_TYPE_NEWS - the account is a news reflector
  86          *      Associated page type: PAGE_FLAGS_SOAPBOX
  87          *
  88          * ACCOUNT_TYPE_COMMUNITY - the account is community forum
  89          *      Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
  90          *
  91          * ACCOUNT_TYPE_RELAY - the account is a relay
  92          *      This will only be assigned to contacts, not to user accounts
  93          * @{
  94          */
  95         const ACCOUNT_TYPE_PERSON =       0;
  96         const ACCOUNT_TYPE_ORGANISATION = 1;
  97         const ACCOUNT_TYPE_NEWS =         2;
  98         const ACCOUNT_TYPE_COMMUNITY =    3;
  99         const ACCOUNT_TYPE_RELAY =        4;
 100         const ACCOUNT_TYPE_DELETED =    127;
 101         /**
 102          * @}
 103          */
 104
 105         private static $owner;
 106
 107         /**
 108          * Returns the numeric account type by their string
 109          *
 110          * @param string $accounttype as string constant
 111          * @return int|null Numeric account type - or null when not set
 112          */
 113         public static function getAccountTypeByString(string $accounttype)
 114         {
 115                 switch ($accounttype) {
 116                         case 'person':
 117                                 return User::ACCOUNT_TYPE_PERSON;
 118                         case 'organisation':
 119                                 return User::ACCOUNT_TYPE_ORGANISATION;
 120                         case 'news':
 121                                 return User::ACCOUNT_TYPE_NEWS;
 122                         case 'community':
 123                                 return User::ACCOUNT_TYPE_COMMUNITY;
 124                         default:
 125                                 return null;
 126                         break;
 127                 }
 128         }
 129
 130         /**
 131          * Fetch the system account
 132          *
 133          * @return array system account
 134          */
 135         public static function getSystemAccount()
 136         {
 137                 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 138                 if (!DBA::isResult($system)) {
 139                         self::createSystemAccount();
 140                         $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 141                         if (!DBA::isResult($system)) {
 142                                 return [];
 143                         }
 144                 }
 145
 146                 $system['sprvkey'] = $system['uprvkey'] = $system['prvkey'];
 147                 $system['spubkey'] = $system['upubkey'] = $system['pubkey'];
 148                 $system['nickname'] = $system['nick'];
 149
 150                 // Ensure that the user contains data
 151                 $user = DBA::selectFirst('user', ['prvkey'], ['uid' => 0]);
 152                 if (empty($user['prvkey'])) {
 153                         $fields = [
 154                                 'username' => $system['name'],
 155                                 'nickname' => $system['nick'],
 156                                 'register_date' => $system['created'],
 157                                 'pubkey' => $system['pubkey'],
 158                                 'prvkey' => $system['prvkey'],
 159                                 'spubkey' => $system['spubkey'],
 160                                 'sprvkey' => $system['sprvkey'],
 161                                 'verified' => true,
 162                                 'page-flags' => User::PAGE_FLAGS_SOAPBOX,
 163                                 'account-type' => User::ACCOUNT_TYPE_RELAY,
 164                         ];
 165
 166                         DBA::update('user', $fields, ['uid' => 0]);
 167                 }
 168
 169                 return $system;
 170         }
 171
 172         /**
 173          * Create the system account
 174          *
 175          * @return void
 176          */
 177         private static function createSystemAccount()
 178         {
 179                 $system_actor_name = self::getActorName();
 180                 if (empty($system_actor_name)) {
 181                         return;
 182                 }
 183
 184                 $keys = Crypto::newKeypair(4096);
 185                 if ($keys === false) {
 186                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 187                 }
 188
 189                 $system = [];
 190                 $system['uid'] = 0;
 191                 $system['created'] = DateTimeFormat::utcNow();
 192                 $system['self'] = true;
 193                 $system['network'] = Protocol::ACTIVITYPUB;
 194                 $system['name'] = 'System Account';
 195                 $system['addr'] = $system_actor_name . '@' . DI::baseUrl()->getHostname();
 196                 $system['nick'] = $system_actor_name;
 197                 $system['url'] = DI::baseUrl() . '/friendica';
 198
 199                 $system['avatar'] = $system['photo'] = Contact::getDefaultAvatar($system, Proxy::SIZE_SMALL);
 200                 $system['thumb'] = Contact::getDefaultAvatar($system, Proxy::SIZE_THUMB);
 201                 $system['micro'] = Contact::getDefaultAvatar($system, Proxy::SIZE_MICRO);
 202
 203                 $system['nurl'] = Strings::normaliseLink($system['url']);
 204                 $system['pubkey'] = $keys['pubkey'];
 205                 $system['prvkey'] = $keys['prvkey'];
 206                 $system['blocked'] = 0;
 207                 $system['pending'] = 0;
 208                 $system['contact-type'] = Contact::TYPE_RELAY; // In AP this is translated to 'Application'
 209                 $system['name-date'] = DateTimeFormat::utcNow();
 210                 $system['uri-date'] = DateTimeFormat::utcNow();
 211                 $system['avatar-date'] = DateTimeFormat::utcNow();
 212                 $system['closeness'] = 0;
 213                 $system['baseurl'] = DI::baseUrl();
 214                 $system['gsid'] = GServer::getID($system['baseurl']);
 215                 DBA::insert('contact', $system);
 216         }
 217
 218         /**
 219          * Detect a usable actor name
 220          *
 221          * @return string actor account name
 222          */
 223         public static function getActorName()
 224         {
 225                 $system_actor_name = DI::config()->get('system', 'actor_name');
 226                 if (!empty($system_actor_name)) {
 227                         $self = Contact::selectFirst(['nick'], ['uid' => 0, 'self' => true]);
 228                         if (!empty($self['nick'])) {
 229                                 if ($self['nick'] != $system_actor_name) {
 230                                         // Reset the actor name to the already used name
 231                                         DI::config()->set('system', 'actor_name', $self['nick']);
 232                                         $system_actor_name = $self['nick'];
 233                                 }
 234                         }
 235                         return $system_actor_name;
 236                 }
 237
 238                 // List of possible actor names
 239                 $possible_accounts = ['friendica', 'actor', 'system', 'internal'];
 240                 foreach ($possible_accounts as $name) {
 241                         if (!DBA::exists('user', ['nickname' => $name, 'account_removed' => false, 'expire' => false]) &&
 242                                 !DBA::exists('userd', ['username' => $name])) {
 243                                 DI::config()->set('system', 'actor_name', $name);
 244                                 return $name;
 245                         }
 246                 }
 247                 return '';
 248         }
 249
 250         /**
 251          * Returns true if a user record exists with the provided id
 252          *
 253          * @param  integer $uid
 254          * @return boolean
 255          * @throws Exception
 256          */
 257         public static function exists($uid)
 258         {
 259                 return DBA::exists('user', ['uid' => $uid]);
 260         }
 261
 262         /**
 263          * @param  integer       $uid
 264          * @param array          $fields
 265          * @return array|boolean User record if it exists, false otherwise
 266          * @throws Exception
 267          */
 268         public static function getById($uid, array $fields = [])
 269         {
 270                 return !empty($uid) ? DBA::selectFirst('user', $fields, ['uid' => $uid]) : [];
 271         }
 272
 273         /**
 274          * Returns a user record based on it's GUID
 275          *
 276          * @param string $guid   The guid of the user
 277          * @param array  $fields The fields to retrieve
 278          * @param bool   $active True, if only active records are searched
 279          *
 280          * @return array|boolean User record if it exists, false otherwise
 281          * @throws Exception
 282          */
 283         public static function getByGuid(string $guid, array $fields = [], bool $active = true)
 284         {
 285                 if ($active) {
 286                         $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
 287                 } else {
 288                         $cond = ['guid' => $guid];
 289                 }
 290
 291                 return DBA::selectFirst('user', $fields, $cond);
 292         }
 293
 294         /**
 295          * @param  string        $nickname
 296          * @param array          $fields
 297          * @return array|boolean User record if it exists, false otherwise
 298          * @throws Exception
 299          */
 300         public static function getByNickname($nickname, array $fields = [])
 301         {
 302                 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
 303         }
 304
 305         /**
 306          * Returns the user id of a given profile URL
 307          *
 308          * @param string $url
 309          *
 310          * @return integer user id
 311          * @throws Exception
 312          */
 313         public static function getIdForURL(string $url)
 314         {
 315                 // Avoid database queries when the local node hostname isn't even part of the url.
 316                 if (!Contact::isLocal($url)) {
 317                         return 0;
 318                 }
 319
 320                 $self = Contact::selectFirst(['uid'], ['self' => true, 'nurl' => Strings::normaliseLink($url)]);
 321                 if (!empty($self['uid'])) {
 322                         return $self['uid'];
 323                 }
 324
 325                 $self = Contact::selectFirst(['uid'], ['self' => true, 'addr' => $url]);
 326                 if (!empty($self['uid'])) {
 327                         return $self['uid'];
 328                 }
 329
 330                 $self = Contact::selectFirst(['uid'], ['self' => true, 'alias' => [$url, Strings::normaliseLink($url)]]);
 331                 if (!empty($self['uid'])) {
 332                         return $self['uid'];
 333                 }
 334
 335                 return 0;
 336         }
 337
 338         /**
 339          * Get a user based on its email
 340          *
 341          * @param string        $email
 342          * @param array          $fields
 343          *
 344          * @return array|boolean User record if it exists, false otherwise
 345          *
 346          * @throws Exception
 347          */
 348         public static function getByEmail($email, array $fields = [])
 349         {
 350                 return DBA::selectFirst('user', $fields, ['email' => $email]);
 351         }
 352
 353         /**
 354          * Fetch the user array of the administrator. The first one if there are several.
 355          *
 356          * @param array $fields
 357          * @return array user
 358          */
 359         public static function getFirstAdmin(array $fields = [])
 360         {
 361                 if (!empty(DI::config()->get('config', 'admin_nickname'))) {
 362                         return self::getByNickname(DI::config()->get('config', 'admin_nickname'), $fields);
 363                 } elseif (!empty(DI::config()->get('config', 'admin_email'))) {
 364                         $adminList = explode(',', str_replace(' ', '', DI::config()->get('config', 'admin_email')));
 365                         return self::getByEmail($adminList[0], $fields);
 366                 } else {
 367                         return [];
 368                 }
 369         }
 370
 371         /**
 372          * Get owner data by user id
 373          *
 374          * @param int     $uid
 375          * @param boolean $repairMissing Repair the owner data if it's missing
 376          * @return boolean|array
 377          * @throws Exception
 378          */
 379         public static function getOwnerDataById(int $uid, bool $repairMissing = true)
 380         {
 381                 if ($uid == 0) {
 382                         return self::getSystemAccount();
 383                 }
 384
 385                 if (!empty(self::$owner[$uid])) {
 386                         return self::$owner[$uid];
 387                 }
 388
 389                 $owner = DBA::selectFirst('owner-view', [], ['uid' => $uid]);
 390                 if (!DBA::isResult($owner)) {
 391                         if (!DBA::exists('user', ['uid' => $uid]) || !$repairMissing) {
 392                                 return false;
 393                         }
 394                         Contact::createSelfFromUserId($uid);
 395                         $owner = self::getOwnerDataById($uid, false);
 396                 }
 397
 398                 if (empty($owner['nickname'])) {
 399                         return false;
 400                 }
 401
 402                 if (!$repairMissing || $owner['account_expired']) {
 403                         return $owner;
 404                 }
 405
 406                 // Check if the returned data is valid, otherwise fix it. See issue #6122
 407
 408                 // Check for correct url and normalised nurl
 409                 $url = DI::baseUrl() . '/profile/' . $owner['nickname'];
 410                 $repair = ($owner['url'] != $url) || ($owner['nurl'] != Strings::normaliseLink($owner['url']));
 411
 412                 if (!$repair) {
 413                         // Check if "addr" is present and correct
 414                         $addr = $owner['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
 415                         $repair = ($addr != $owner['addr']) || empty($owner['prvkey']) || empty($owner['pubkey']);
 416                 }
 417
 418                 if (!$repair) {
 419                         // Check if the avatar field is filled and the photo directs to the correct path
 420                         $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
 421                         if (DBA::isResult($avatar)) {
 422                                 $repair = empty($owner['avatar']) || !strpos($owner['photo'], $avatar['resource-id']);
 423                         }
 424                 }
 425
 426                 if ($repair) {
 427                         Contact::updateSelfFromUserID($uid);
 428                         // Return the corrected data and avoid a loop
 429                         $owner = self::getOwnerDataById($uid, false);
 430                 }
 431
 432                 self::$owner[$uid] = $owner;
 433                 return $owner;
 434         }
 435
 436         /**
 437          * Get owner data by nick name
 438          *
 439          * @param int $nick
 440          * @return boolean|array
 441          * @throws Exception
 442          */
 443         public static function getOwnerDataByNick($nick)
 444         {
 445                 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
 446
 447                 if (!DBA::isResult($user)) {
 448                         return false;
 449                 }
 450
 451                 return self::getOwnerDataById($user['uid']);
 452         }
 453
 454         /**
 455          * Returns the default group for a given user and network
 456          *
 457          * @param int    $uid     User id
 458          * @param string $network network name
 459          *
 460          * @return int group id
 461          * @throws Exception
 462          */
 463         public static function getDefaultGroup($uid, $network = '')
 464         {
 465                 $default_group = 0;
 466
 467                 if ($network == Protocol::OSTATUS) {
 468                         $default_group = DI::pConfig()->get($uid, "ostatus", "default_group");
 469                 }
 470
 471                 if ($default_group != 0) {
 472                         return $default_group;
 473                 }
 474
 475                 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
 476
 477                 if (DBA::isResult($user)) {
 478                         $default_group = $user["def_gid"];
 479                 }
 480
 481                 return $default_group;
 482         }
 483
 484
 485         /**
 486          * Authenticate a user with a clear text password
 487          *
 488          * @param mixed  $user_info
 489          * @param string $password
 490          * @param bool   $third_party
 491          * @return int|boolean
 492          * @deprecated since version 3.6
 493          * @see        User::getIdFromPasswordAuthentication()
 494          */
 495         public static function authenticate($user_info, $password, $third_party = false)
 496         {
 497                 try {
 498                         return self::getIdFromPasswordAuthentication($user_info, $password, $third_party);
 499                 } catch (Exception $ex) {
 500                         return false;
 501                 }
 502         }
 503
 504         /**
 505          * Authenticate a user with a clear text password
 506          *
 507          * Returns the user id associated with a successful password authentication
 508          *
 509          * @param mixed  $user_info
 510          * @param string $password
 511          * @param bool   $third_party
 512          * @return int User Id if authentication is successful
 513          * @throws HTTPException\ForbiddenException
 514          * @throws HTTPException\NotFoundException
 515          */
 516         public static function getIdFromPasswordAuthentication($user_info, $password, $third_party = false)
 517         {
 518                 // Addons registered with the "authenticate" hook may create the user on the
 519                 // fly. `getAuthenticationInfo` will fail if the user doesn't exist yet. If
 520                 // the user doesn't exist, we should give the addons a chance to create the
 521                 // user in our database, if applicable, before re-throwing the exception if
 522                 // they fail.
 523                 try {
 524                         $user = self::getAuthenticationInfo($user_info);
 525                 } catch (Exception $e) {
 526                         $username = (is_string($user_info) ? $user_info : $user_info['nickname'] ?? '');
 527
 528                         // Addons can create users, and since this 'catch' branch should only
 529                         // execute if getAuthenticationInfo can't find an existing user, that's
 530                         // exactly what will happen here. Creating a numeric username would create
 531                         // abiguity with user IDs, possibly opening up an attack vector.
 532                         // So let's be very careful about that.
 533                         if (empty($username) || is_numeric($username)) {
 534                                 throw $e;
 535                         }
 536
 537                         return self::getIdFromAuthenticateHooks($username, $password);
 538                 }
 539
 540                 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
 541                         // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
 542                         if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
 543                                 return $user['uid'];
 544                         }
 545                 } elseif (strpos($user['password'], '$') === false) {
 546                         //Legacy hash that has not been replaced by a new hash yet
 547                         if (self::hashPasswordLegacy($password) === $user['password']) {
 548                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 549
 550                                 return $user['uid'];
 551                         }
 552                 } elseif (!empty($user['legacy_password'])) {
 553                         //Legacy hash that has been double-hashed and not replaced by a new hash yet
 554                         //Warning: `legacy_password` is not necessary in sync with the content of `password`
 555                         if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
 556                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 557
 558                                 return $user['uid'];
 559                         }
 560                 } elseif (password_verify($password, $user['password'])) {
 561                         //New password hash
 562                         if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
 563                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 564                         }
 565
 566                         return $user['uid'];
 567                 } else {
 568                         return self::getIdFromAuthenticateHooks($user['nickname'], $password); // throws
 569                 }
 570
 571                 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
 572         }
 573
 574         /**
 575          * Try to obtain a user ID via "authenticate" hook addons
 576          *
 577          * Returns the user id associated with a successful password authentication
 578          *
 579          * @param string $username
 580          * @param string $password
 581          * @return int User Id if authentication is successful
 582          * @throws HTTPException\ForbiddenException
 583          */
 584         public static function getIdFromAuthenticateHooks($username, $password)
 585         {
 586                 $addon_auth = [
 587                         'username'      => $username,
 588                         'password'      => $password,
 589                         'authenticated' => 0,
 590                         'user_record'   => null
 591                 ];
 592
 593                 /*
 594                  * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
 595                  * Addons should never set 'authenticated' except to indicate success - as hooks may be chained
 596                  * and later addons should not interfere with an earlier one that succeeded.
 597                  */
 598                 Hook::callAll('authenticate', $addon_auth);
 599
 600                 if ($addon_auth['authenticated'] && $addon_auth['user_record']) {
 601                         return $addon_auth['user_record']['uid'];
 602                 }
 603
 604                 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
 605         }
 606
 607         /**
 608          * Returns authentication info from various parameters types
 609          *
 610          * User info can be any of the following:
 611          * - User DB object
 612          * - User Id
 613          * - User email or username or nickname
 614          * - User array with at least the uid and the hashed password
 615          *
 616          * @param mixed $user_info
 617          * @return array
 618          * @throws HTTPException\NotFoundException
 619          */
 620         public static function getAuthenticationInfo($user_info)
 621         {
 622                 $user = null;
 623
 624                 if (is_object($user_info) || is_array($user_info)) {
 625                         if (is_object($user_info)) {
 626                                 $user = (array) $user_info;
 627                         } else {
 628                                 $user = $user_info;
 629                         }
 630
 631                         if (
 632                                 !isset($user['uid'])
 633                                 || !isset($user['password'])
 634                                 || !isset($user['legacy_password'])
 635                         ) {
 636                                 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
 637                         }
 638                 } elseif (is_int($user_info) || is_string($user_info)) {
 639                         if (is_int($user_info)) {
 640                                 $user = DBA::selectFirst(
 641                                         'user',
 642                                         ['uid', 'nickname', 'password', 'legacy_password'],
 643                                         [
 644                                                 'uid' => $user_info,
 645                                                 'blocked' => 0,
 646                                                 'account_expired' => 0,
 647                                                 'account_removed' => 0,
 648                                                 'verified' => 1
 649                                         ]
 650                                 );
 651                         } else {
 652                                 $fields = ['uid', 'nickname', 'password', 'legacy_password'];
 653                                 $condition = [
 654                                         "(`email` = ? OR `username` = ? OR `nickname` = ?)
 655                                         AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
 656                                         $user_info, $user_info, $user_info
 657                                 ];
 658                                 $user = DBA::selectFirst('user', $fields, $condition);
 659                         }
 660
 661                         if (!DBA::isResult($user)) {
 662                                 throw new HTTPException\NotFoundException(DI::l10n()->t('User not found'));
 663                         }
 664                 }
 665
 666                 return $user;
 667         }
 668
 669         /**
 670          * Generates a human-readable random password
 671          *
 672          * @return string
 673          * @throws Exception
 674          */
 675         public static function generateNewPassword()
 676         {
 677                 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
 678         }
 679
 680         /**
 681          * Checks if the provided plaintext password has been exposed or not
 682          *
 683          * @param string $password
 684          * @return bool
 685          * @throws Exception
 686          */
 687         public static function isPasswordExposed($password)
 688         {
 689                 $cache = new CacheItemPool();
 690                 $cache->changeConfig([
 691                         'cacheDirectory' => get_temppath() . '/password-exposed-cache/',
 692                 ]);
 693
 694                 try {
 695                         $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
 696
 697                         return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
 698                 } catch (Exception $e) {
 699                         Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
 700                                 'code' => $e->getCode(),
 701                                 'file' => $e->getFile(),
 702                                 'line' => $e->getLine(),
 703                                 'trace' => $e->getTraceAsString()
 704                         ]);
 705
 706                         return false;
 707                 }
 708         }
 709
 710         /**
 711          * Legacy hashing function, kept for password migration purposes
 712          *
 713          * @param string $password
 714          * @return string
 715          */
 716         private static function hashPasswordLegacy($password)
 717         {
 718                 return hash('whirlpool', $password);
 719         }
 720
 721         /**
 722          * Global user password hashing function
 723          *
 724          * @param string $password
 725          * @return string
 726          * @throws Exception
 727          */
 728         public static function hashPassword($password)
 729         {
 730                 if (!trim($password)) {
 731                         throw new Exception(DI::l10n()->t('Password can\'t be empty'));
 732                 }
 733
 734                 return password_hash($password, PASSWORD_DEFAULT);
 735         }
 736
 737         /**
 738          * Updates a user row with a new plaintext password
 739          *
 740          * @param int    $uid
 741          * @param string $password
 742          * @return bool
 743          * @throws Exception
 744          */
 745         public static function updatePassword($uid, $password)
 746         {
 747                 $password = trim($password);
 748
 749                 if (empty($password)) {
 750                         throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
 751                 }
 752
 753                 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
 754                         throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
 755                 }
 756
 757                 $allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
 758
 759                 if (!preg_match('/^[a-z0-9' . preg_quote($allowed_characters, '/') . ']+$/i', $password)) {
 760                         throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
 761                 }
 762
 763                 return self::updatePasswordHashed($uid, self::hashPassword($password));
 764         }
 765
 766         /**
 767          * Updates a user row with a new hashed password.
 768          * Empties the password reset token field just in case.
 769          *
 770          * @param int    $uid
 771          * @param string $pasword_hashed
 772          * @return bool
 773          * @throws Exception
 774          */
 775         private static function updatePasswordHashed($uid, $pasword_hashed)
 776         {
 777                 $fields = [
 778                         'password' => $pasword_hashed,
 779                         'pwdreset' => null,
 780                         'pwdreset_time' => null,
 781                         'legacy_password' => false
 782                 ];
 783                 return DBA::update('user', $fields, ['uid' => $uid]);
 784         }
 785
 786         /**
 787          * Checks if a nickname is in the list of the forbidden nicknames
 788          *
 789          * Check if a nickname is forbidden from registration on the node by the
 790          * admin. Forbidden nicknames (e.g. role namess) can be configured in the
 791          * admin panel.
 792          *
 793          * @param string $nickname The nickname that should be checked
 794          * @return boolean True is the nickname is blocked on the node
 795          */
 796         public static function isNicknameBlocked($nickname)
 797         {
 798                 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
 799                 if (!empty($forbidden_nicknames)) {
 800                         $forbidden = explode(',', $forbidden_nicknames);
 801                         $forbidden = array_map('trim', $forbidden);
 802                 } else {
 803                         $forbidden = [];
 804                 }
 805
 806                 // Add the name of the internal actor to the "forbidden" list
 807                 $actor_name = self::getActorName();
 808                 if (!empty($actor_name)) {
 809                         $forbidden[] = $actor_name;
 810                 }
 811
 812                 if (empty($forbidden)) {
 813                         return false;
 814                 }
 815
 816                 // check if the nickname is in the list of blocked nicknames
 817                 if (in_array(strtolower($nickname), $forbidden)) {
 818                         return true;
 819                 }
 820
 821                 // else return false
 822                 return false;
 823         }
 824
 825         /**
 826          * Catch-all user creation function
 827          *
 828          * Creates a user from the provided data array, either form fields or OpenID.
 829          * Required: { username, nickname, email } or { openid_url }
 830          *
 831          * Performs the following:
 832          * - Sends to the OpenId auth URL (if relevant)
 833          * - Creates new key pairs for crypto
 834          * - Create self-contact
 835          * - Create profile image
 836          *
 837          * @param  array $data
 838          * @return array
 839          * @throws ErrorException
 840          * @throws HTTPException\InternalServerErrorException
 841          * @throws ImagickException
 842          * @throws Exception
 843          */
 844         public static function create(array $data)
 845         {
 846                 $return = ['user' => null, 'password' => ''];
 847
 848                 $using_invites = DI::config()->get('system', 'invitation_only');
 849
 850                 $invite_id  = !empty($data['invite_id'])  ? Strings::escapeTags(trim($data['invite_id']))  : '';
 851                 $username   = !empty($data['username'])   ? Strings::escapeTags(trim($data['username']))   : '';
 852                 $nickname   = !empty($data['nickname'])   ? Strings::escapeTags(trim($data['nickname']))   : '';
 853                 $email      = !empty($data['email'])      ? Strings::escapeTags(trim($data['email']))      : '';
 854                 $openid_url = !empty($data['openid_url']) ? Strings::escapeTags(trim($data['openid_url'])) : '';
 855                 $photo      = !empty($data['photo'])      ? Strings::escapeTags(trim($data['photo']))      : '';
 856                 $password   = !empty($data['password'])   ? trim($data['password'])           : '';
 857                 $password1  = !empty($data['password1'])  ? trim($data['password1'])          : '';
 858                 $confirm    = !empty($data['confirm'])    ? trim($data['confirm'])            : '';
 859                 $blocked    = !empty($data['blocked']);
 860                 $verified   = !empty($data['verified']);
 861                 $language   = !empty($data['language'])   ? Strings::escapeTags(trim($data['language']))   : 'en';
 862
 863                 $netpublish = $publish = !empty($data['profile_publish_reg']);
 864
 865                 if ($password1 != $confirm) {
 866                         throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
 867                 } elseif ($password1 != '') {
 868                         $password = $password1;
 869                 }
 870
 871                 if ($using_invites) {
 872                         if (!$invite_id) {
 873                                 throw new Exception(DI::l10n()->t('An invitation is required.'));
 874                         }
 875
 876                         if (!Register::existsByHash($invite_id)) {
 877                                 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
 878                         }
 879                 }
 880
 881                 /// @todo Check if this part is really needed. We should have fetched all this data in advance
 882                 if (empty($username) || empty($email) || empty($nickname)) {
 883                         if ($openid_url) {
 884                                 if (!Network::isUrlValid($openid_url)) {
 885                                         throw new Exception(DI::l10n()->t('Invalid OpenID url'));
 886                                 }
 887                                 $_SESSION['register'] = 1;
 888                                 $_SESSION['openid'] = $openid_url;
 889
 890                                 $openid = new LightOpenID(DI::baseUrl()->getHostname());
 891                                 $openid->identity = $openid_url;
 892                                 $openid->returnUrl = DI::baseUrl() . '/openid';
 893                                 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
 894                                 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
 895                                 try {
 896                                         $authurl = $openid->authUrl();
 897                                 } catch (Exception $e) {
 898                                         throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . EOL . EOL . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
 899                                 }
 900                                 System::externalRedirect($authurl);
 901                                 // NOTREACHED
 902                         }
 903
 904                         throw new Exception(DI::l10n()->t('Please enter the required information.'));
 905                 }
 906
 907                 if (!Network::isUrlValid($openid_url)) {
 908                         $openid_url = '';
 909                 }
 910
 911                 // collapse multiple spaces in name
 912                 $username = preg_replace('/ +/', ' ', $username);
 913
 914                 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
 915                 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
 916
 917                 if ($username_min_length > $username_max_length) {
 918                         Logger::log(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length), Logger::WARNING);
 919                         $tmp = $username_min_length;
 920                         $username_min_length = $username_max_length;
 921                         $username_max_length = $tmp;
 922                 }
 923
 924                 if (mb_strlen($username) < $username_min_length) {
 925                         throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
 926                 }
 927
 928                 if (mb_strlen($username) > $username_max_length) {
 929                         throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
 930                 }
 931
 932                 // So now we are just looking for a space in the full name.
 933                 $loose_reg = DI::config()->get('system', 'no_regfullname');
 934                 if (!$loose_reg) {
 935                         $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
 936                         if (strpos($username, ' ') === false) {
 937                                 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
 938                         }
 939                 }
 940
 941                 if (!Network::isEmailDomainAllowed($email)) {
 942                         throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
 943                 }
 944
 945                 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
 946                         throw new Exception(DI::l10n()->t('Not a valid email address.'));
 947                 }
 948                 if (self::isNicknameBlocked($nickname)) {
 949                         throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
 950                 }
 951
 952                 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
 953                         throw new Exception(DI::l10n()->t('Cannot use that email.'));
 954                 }
 955
 956                 // Disallow somebody creating an account using openid that uses the admin email address,
 957                 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
 958                 if (DI::config()->get('config', 'admin_email') && strlen($openid_url)) {
 959                         $adminlist = explode(',', str_replace(' ', '', strtolower(DI::config()->get('config', 'admin_email'))));
 960                         if (in_array(strtolower($email), $adminlist)) {
 961                                 throw new Exception(DI::l10n()->t('Cannot use that email.'));
 962                         }
 963                 }
 964
 965                 $nickname = $data['nickname'] = strtolower($nickname);
 966
 967                 if (!preg_match('/^[a-z0-9][a-z0-9_]*$/', $nickname)) {
 968                         throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
 969                 }
 970
 971                 // Check existing and deleted accounts for this nickname.
 972                 if (
 973                         DBA::exists('user', ['nickname' => $nickname])
 974                         || DBA::exists('userd', ['username' => $nickname])
 975                 ) {
 976                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
 977                 }
 978
 979                 $new_password = strlen($password) ? $password : User::generateNewPassword();
 980                 $new_password_encoded = self::hashPassword($new_password);
 981
 982                 $return['password'] = $new_password;
 983
 984                 $keys = Crypto::newKeypair(4096);
 985                 if ($keys === false) {
 986                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 987                 }
 988
 989                 $prvkey = $keys['prvkey'];
 990                 $pubkey = $keys['pubkey'];
 991
 992                 // Create another keypair for signing/verifying salmon protocol messages.
 993                 $sres = Crypto::newKeypair(512);
 994                 $sprvkey = $sres['prvkey'];
 995                 $spubkey = $sres['pubkey'];
 996
 997                 $insert_result = DBA::insert('user', [
 998                         'guid'     => System::createUUID(),
 999                         'username' => $username,
1000                         'password' => $new_password_encoded,
1001                         'email'    => $email,
1002                         'openid'   => $openid_url,
1003                         'nickname' => $nickname,
1004                         'pubkey'   => $pubkey,
1005                         'prvkey'   => $prvkey,
1006                         'spubkey'  => $spubkey,
1007                         'sprvkey'  => $sprvkey,
1008                         'verified' => $verified,
1009                         'blocked'  => $blocked,
1010                         'language' => $language,
1011                         'timezone' => 'UTC',
1012                         'register_date' => DateTimeFormat::utcNow(),
1013                         'default-location' => ''
1014                 ]);
1015
1016                 if ($insert_result) {
1017                         $uid = DBA::lastInsertId();
1018                         $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1019                 } else {
1020                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1021                 }
1022
1023                 if (!$uid) {
1024                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1025                 }
1026
1027                 // if somebody clicked submit twice very quickly, they could end up with two accounts
1028                 // due to race condition. Remove this one.
1029                 $user_count = DBA::count('user', ['nickname' => $nickname]);
1030                 if ($user_count > 1) {
1031                         DBA::delete('user', ['uid' => $uid]);
1032
1033                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
1034                 }
1035
1036                 $insert_result = DBA::insert('profile', [
1037                         'uid' => $uid,
1038                         'name' => $username,
1039                         'photo' => DI::baseUrl() . "/photo/profile/{$uid}.jpg",
1040                         'thumb' => DI::baseUrl() . "/photo/avatar/{$uid}.jpg",
1041                         'publish' => $publish,
1042                         'net-publish' => $netpublish,
1043                 ]);
1044                 if (!$insert_result) {
1045                         DBA::delete('user', ['uid' => $uid]);
1046
1047                         throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
1048                 }
1049
1050                 // Create the self contact
1051                 if (!Contact::createSelfFromUserId($uid)) {
1052                         DBA::delete('user', ['uid' => $uid]);
1053
1054                         throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
1055                 }
1056
1057                 // Create a group with no members. This allows somebody to use it
1058                 // right away as a default group for new contacts.
1059                 $def_gid = Group::create($uid, DI::l10n()->t('Friends'));
1060                 if (!$def_gid) {
1061                         DBA::delete('user', ['uid' => $uid]);
1062
1063                         throw new Exception(DI::l10n()->t('An error occurred creating your default contact group. Please try again.'));
1064                 }
1065
1066                 $fields = ['def_gid' => $def_gid];
1067                 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
1068                         $fields['allow_gid'] = '<' . $def_gid . '>';
1069                 }
1070
1071                 DBA::update('user', $fields, ['uid' => $uid]);
1072
1073                 // if we have no OpenID photo try to look up an avatar
1074                 if (!strlen($photo)) {
1075                         $photo = Network::lookupAvatarByEmail($email);
1076                 }
1077
1078                 // unless there is no avatar-addon loaded
1079                 if (strlen($photo)) {
1080                         $photo_failure = false;
1081
1082                         $filename = basename($photo);
1083                         $curlResult = DI::httpRequest()->get($photo);
1084                         if ($curlResult->isSuccess()) {
1085                                 $img_str = $curlResult->getBody();
1086                                 $type = $curlResult->getContentType();
1087                         } else {
1088                                 $img_str = '';
1089                                 $type = '';
1090                         }
1091
1092                         $type = Images::getMimeTypeByData($img_str, $photo, $type);
1093
1094                         $Image = new Image($img_str, $type);
1095                         if ($Image->isValid()) {
1096                                 $Image->scaleToSquare(300);
1097
1098                                 $resource_id = Photo::newResource();
1099
1100                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 4);
1101
1102                                 if ($r === false) {
1103                                         $photo_failure = true;
1104                                 }
1105
1106                                 $Image->scaleDown(80);
1107
1108                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 5);
1109
1110                                 if ($r === false) {
1111                                         $photo_failure = true;
1112                                 }
1113
1114                                 $Image->scaleDown(48);
1115
1116                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 6);
1117
1118                                 if ($r === false) {
1119                                         $photo_failure = true;
1120                                 }
1121
1122                                 if (!$photo_failure) {
1123                                         Photo::update(['profile' => 1], ['resource-id' => $resource_id]);
1124                                 }
1125                         }
1126
1127                         Contact::updateSelfFromUserID($uid, true);
1128                 }
1129
1130                 Hook::callAll('register_account', $uid);
1131
1132                 $return['user'] = $user;
1133                 return $return;
1134         }
1135
1136         /**
1137          * Sets block state for a given user
1138          *
1139          * @param int  $uid   The user id
1140          * @param bool $block Block state (default is true)
1141          *
1142          * @return bool True, if successfully blocked
1143
1144          * @throws Exception
1145          */
1146         public static function block(int $uid, bool $block = true)
1147         {
1148                 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
1149         }
1150
1151         /**
1152          * Allows a registration based on a hash
1153          *
1154          * @param string $hash
1155          *
1156          * @return bool True, if the allow was successful
1157          *
1158          * @throws HTTPException\InternalServerErrorException
1159          * @throws Exception
1160          */
1161         public static function allow(string $hash)
1162         {
1163                 $register = Register::getByHash($hash);
1164                 if (!DBA::isResult($register)) {
1165                         return false;
1166                 }
1167
1168                 $user = User::getById($register['uid']);
1169                 if (!DBA::isResult($user)) {
1170                         return false;
1171                 }
1172
1173                 Register::deleteByHash($hash);
1174
1175                 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
1176
1177                 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
1178
1179                 if (DBA::isResult($profile) && $profile['net-publish'] && DI::config()->get('system', 'directory')) {
1180                         $url = DI::baseUrl() . '/profile/' . $user['nickname'];
1181                         Worker::add(PRIORITY_LOW, "Directory", $url);
1182                 }
1183
1184                 $l10n = DI::l10n()->withLang($register['language']);
1185
1186                 return User::sendRegisterOpenEmail(
1187                         $l10n,
1188                         $user,
1189                         DI::config()->get('config', 'sitename'),
1190                         DI::baseUrl()->get(),
1191                         ($register['password'] ?? '') ?: 'Sent in a previous email'
1192                 );
1193         }
1194
1195         /**
1196          * Denys a pending registration
1197          *
1198          * @param string $hash The hash of the pending user
1199          *
1200          * This does not have to go through user_remove() and save the nickname
1201          * permanently against re-registration, as the person was not yet
1202          * allowed to have friends on this system
1203          *
1204          * @return bool True, if the deny was successfull
1205          * @throws Exception
1206          */
1207         public static function deny(string $hash)
1208         {
1209                 $register = Register::getByHash($hash);
1210                 if (!DBA::isResult($register)) {
1211                         return false;
1212                 }
1213
1214                 $user = User::getById($register['uid']);
1215                 if (!DBA::isResult($user)) {
1216                         return false;
1217                 }
1218
1219                 // Delete the avatar
1220                 Photo::delete(['uid' => $register['uid']]);
1221
1222                 return DBA::delete('user', ['uid' => $register['uid']]) &&
1223                        Register::deleteByHash($register['hash']);
1224         }
1225
1226         /**
1227          * Creates a new user based on a minimal set and sends an email to this user
1228          *
1229          * @param string $name  The user's name
1230          * @param string $email The user's email address
1231          * @param string $nick  The user's nick name
1232          * @param string $lang  The user's language (default is english)
1233          *
1234          * @return bool True, if the user was created successfully
1235          * @throws HTTPException\InternalServerErrorException
1236          * @throws ErrorException
1237          * @throws ImagickException
1238          */
1239         public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT)
1240         {
1241                 if (empty($name) ||
1242                     empty($email) ||
1243                     empty($nick)) {
1244                         throw new HTTPException\InternalServerErrorException('Invalid arguments.');
1245                 }
1246
1247                 $result = self::create([
1248                         'username' => $name,
1249                         'email' => $email,
1250                         'nickname' => $nick,
1251                         'verified' => 1,
1252                         'language' => $lang
1253                 ]);
1254
1255                 $user = $result['user'];
1256                 $preamble = Strings::deindent(DI::l10n()->t('
1257                 Dear %1$s,
1258                         the administrator of %2$s has set up an account for you.'));
1259                 $body = Strings::deindent(DI::l10n()->t('
1260                 The login details are as follows:
1261
1262                 Site Location:  %1$s
1263                 Login Name:             %2$s
1264                 Password:               %3$s
1265
1266                 You may change your password from your account "Settings" page after logging
1267                 in.
1268
1269                 Please take a few moments to review the other account settings on that page.
1270
1271                 You may also wish to add some basic information to your default profile
1272                 (on the "Profiles" page) so that other people can easily find you.
1273
1274                 We recommend setting your full name, adding a profile photo,
1275                 adding some profile "keywords" (very useful in making new friends) - and
1276                 perhaps what country you live in; if you do not wish to be more specific
1277                 than that.
1278
1279                 We fully respect your right to privacy, and none of these items are necessary.
1280                 If you are new and do not know anybody here, they may help
1281                 you to make some new and interesting friends.
1282
1283                 If you ever want to delete your account, you can do so at %1$s/removeme
1284
1285                 Thank you and welcome to %4$s.'));
1286
1287                 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1288                 $body = sprintf($body, DI::baseUrl()->get(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1289
1290                 $email = DI::emailer()
1291                         ->newSystemMail()
1292                         ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1293                         ->forUser($user)
1294                         ->withRecipient($user['email'])
1295                         ->build();
1296                 return DI::emailer()->send($email);
1297         }
1298
1299         /**
1300          * Sends pending registration confirmation email
1301          *
1302          * @param array  $user     User record array
1303          * @param string $sitename
1304          * @param string $siteurl
1305          * @param string $password Plaintext password
1306          * @return NULL|boolean from notification() and email() inherited
1307          * @throws HTTPException\InternalServerErrorException
1308          */
1309         public static function sendRegisterPendingEmail($user, $sitename, $siteurl, $password)
1310         {
1311                 $body = Strings::deindent(DI::l10n()->t(
1312                         '
1313                         Dear %1$s,
1314                                 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1315
1316                         Your login details are as follows:
1317
1318                         Site Location:  %3$s
1319                         Login Name:             %4$s
1320                         Password:               %5$s
1321                 ',
1322                         $user['username'],
1323                         $sitename,
1324                         $siteurl,
1325                         $user['nickname'],
1326                         $password
1327                 ));
1328
1329                 $email = DI::emailer()
1330                         ->newSystemMail()
1331                         ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1332                         ->forUser($user)
1333                         ->withRecipient($user['email'])
1334                         ->build();
1335                 return DI::emailer()->send($email);
1336         }
1337
1338         /**
1339          * Sends registration confirmation
1340          *
1341          * It's here as a function because the mail is sent from different parts
1342          *
1343          * @param L10n   $l10n     The used language
1344          * @param array  $user     User record array
1345          * @param string $sitename
1346          * @param string $siteurl
1347          * @param string $password Plaintext password
1348          *
1349          * @return NULL|boolean from notification() and email() inherited
1350          * @throws HTTPException\InternalServerErrorException
1351          */
1352         public static function sendRegisterOpenEmail(L10n $l10n, $user, $sitename, $siteurl, $password)
1353         {
1354                 $preamble = Strings::deindent($l10n->t(
1355                         '
1356                                 Dear %1$s,
1357                                 Thank you for registering at %2$s. Your account has been created.
1358                         ',
1359                         $user['username'],
1360                         $sitename
1361                 ));
1362                 $body = Strings::deindent($l10n->t(
1363                         '
1364                         The login details are as follows:
1365
1366                         Site Location:  %3$s
1367                         Login Name:             %1$s
1368                         Password:               %5$s
1369
1370                         You may change your password from your account "Settings" page after logging
1371                         in.
1372
1373                         Please take a few moments to review the other account settings on that page.
1374
1375                         You may also wish to add some basic information to your default profile
1376                         ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1377
1378                         We recommend setting your full name, adding a profile photo,
1379                         adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1380                         perhaps what country you live in; if you do not wish to be more specific
1381                         than that.
1382
1383                         We fully respect your right to privacy, and none of these items are necessary.
1384                         If you are new and do not know anybody here, they may help
1385                         you to make some new and interesting friends.
1386
1387                         If you ever want to delete your account, you can do so at %3$s/removeme
1388
1389                         Thank you and welcome to %2$s.',
1390                         $user['nickname'],
1391                         $sitename,
1392                         $siteurl,
1393                         $user['username'],
1394                         $password
1395                 ));
1396
1397                 $email = DI::emailer()
1398                         ->newSystemMail()
1399                         ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1400                         ->forUser($user)
1401                         ->withRecipient($user['email'])
1402                         ->build();
1403                 return DI::emailer()->send($email);
1404         }
1405
1406         /**
1407          * @param int $uid user to remove
1408          * @return bool
1409          * @throws HTTPException\InternalServerErrorException
1410          */
1411         public static function remove(int $uid)
1412         {
1413                 if (empty($uid)) {
1414                         return false;
1415                 }
1416
1417                 Logger::log('Removing user: ' . $uid);
1418
1419                 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1420
1421                 Hook::callAll('remove_user', $user);
1422
1423                 // save username (actually the nickname as it is guaranteed
1424                 // unique), so it cannot be re-registered in the future.
1425                 DBA::insert('userd', ['username' => $user['nickname']]);
1426
1427                 // Remove all personal settings, especially connector settings
1428                 DBA::delete('pconfig', ['uid' => $uid]);
1429
1430                 // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
1431                 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1432                 Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1433
1434                 // Send an update to the directory
1435                 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1436                 Worker::add(PRIORITY_LOW, 'Directory', $self['url']);
1437
1438                 // Remove the user relevant data
1439                 Worker::add(PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1440
1441                 return true;
1442         }
1443
1444         /**
1445          * Return all identities to a user
1446          *
1447          * @param int $uid The user id
1448          * @return array All identities for this user
1449          *
1450          * Example for a return:
1451          *    [
1452          *        [
1453          *            'uid' => 1,
1454          *            'username' => 'maxmuster',
1455          *            'nickname' => 'Max Mustermann'
1456          *        ],
1457          *        [
1458          *            'uid' => 2,
1459          *            'username' => 'johndoe',
1460          *            'nickname' => 'John Doe'
1461          *        ]
1462          *    ]
1463          * @throws Exception
1464          */
1465         public static function identities($uid)
1466         {
1467                 $identities = [];
1468
1469                 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1470                 if (!DBA::isResult($user)) {
1471                         return $identities;
1472                 }
1473
1474                 if ($user['parent-uid'] == 0) {
1475                         // First add our own entry
1476                         $identities = [[
1477                                 'uid' => $user['uid'],
1478                                 'username' => $user['username'],
1479                                 'nickname' => $user['nickname']
1480                         ]];
1481
1482                         // Then add all the children
1483                         $r = DBA::select(
1484                                 'user',
1485                                 ['uid', 'username', 'nickname'],
1486                                 ['parent-uid' => $user['uid'], 'account_removed' => false]
1487                         );
1488                         if (DBA::isResult($r)) {
1489                                 $identities = array_merge($identities, DBA::toArray($r));
1490                         }
1491                 } else {
1492                         // First entry is our parent
1493                         $r = DBA::select(
1494                                 'user',
1495                                 ['uid', 'username', 'nickname'],
1496                                 ['uid' => $user['parent-uid'], 'account_removed' => false]
1497                         );
1498                         if (DBA::isResult($r)) {
1499                                 $identities = DBA::toArray($r);
1500                         }
1501
1502                         // Then add all siblings
1503                         $r = DBA::select(
1504                                 'user',
1505                                 ['uid', 'username', 'nickname'],
1506                                 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1507                         );
1508                         if (DBA::isResult($r)) {
1509                                 $identities = array_merge($identities, DBA::toArray($r));
1510                         }
1511                 }
1512
1513                 $r = DBA::p(
1514                         "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1515                         FROM `manage`
1516                         INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1517                         WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1518                         $user['uid']
1519                 );
1520                 if (DBA::isResult($r)) {
1521                         $identities = array_merge($identities, DBA::toArray($r));
1522                 }
1523
1524                 return $identities;
1525         }
1526
1527         /**
1528          * Returns statistical information about the current users of this node
1529          *
1530          * @return array
1531          *
1532          * @throws Exception
1533          */
1534         public static function getStatistics()
1535         {
1536                 $statistics = [
1537                         'total_users'           => 0,
1538                         'active_users_halfyear' => 0,
1539                         'active_users_monthly'  => 0,
1540                         'active_users_weekly'   => 0,
1541                 ];
1542
1543                 $userStmt = DBA::select('owner-view', ['uid', 'login_date', 'last-item'],
1544                         ["`verified` AND `login_date` > ? AND NOT `blocked`
1545                         AND NOT `account_removed` AND NOT `account_expired`",
1546                         DBA::NULL_DATETIME]);
1547                 if (!DBA::isResult($userStmt)) {
1548                         return $statistics;
1549                 }
1550
1551                 $halfyear = time() - (180 * 24 * 60 * 60);
1552                 $month = time() - (30 * 24 * 60 * 60);
1553                 $week = time() - (7 * 24 * 60 * 60);
1554
1555                 while ($user = DBA::fetch($userStmt)) {
1556                         $statistics['total_users']++;
1557
1558                         if ((strtotime($user['login_date']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1559                         ) {
1560                                 $statistics['active_users_halfyear']++;
1561                         }
1562
1563                         if ((strtotime($user['login_date']) > $month) || (strtotime($user['last-item']) > $month)
1564                         ) {
1565                                 $statistics['active_users_monthly']++;
1566                         }
1567
1568                         if ((strtotime($user['login_date']) > $week) || (strtotime($user['last-item']) > $week)
1569                         ) {
1570                                 $statistics['active_users_weekly']++;
1571                         }
1572                 }
1573                 DBA::close($userStmt);
1574
1575                 return $statistics;
1576         }
1577
1578         /**
1579          * Get all users of the current node
1580          *
1581          * @param int    $start Start count (Default is 0)
1582          * @param int    $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1583          * @param string $type  The type of users, which should get (all, bocked, removed)
1584          * @param string $order Order of the user list (Default is 'contact.name')
1585          * @param bool   $descending Order direction (Default is ascending)
1586          *
1587          * @return array The list of the users
1588          * @throws Exception
1589          */
1590         public static function getList($start = 0, $count = Pager::ITEMS_PER_PAGE, $type = 'all', $order = 'name', bool $descending = false)
1591         {
1592                 $param = ['limit' => [$start, $count], 'order' => [$order => $descending]];
1593                 $condition = [];
1594                 switch ($type) {
1595                         case 'active':
1596                                 $condition['account_removed'] = false;
1597                                 $condition['blocked'] = false;
1598                                 break;
1599                         case 'blocked':
1600                                 $condition['account_removed'] = false;
1601                                 $condition['blocked'] = true;
1602                                 $condition['verified'] = true;
1603                                 break;
1604                         case 'removed':
1605                                 $condition['account_removed'] = true;
1606                                 break;
1607                 }
1608
1609                 return DBA::selectToArray('owner-view', [], $condition, $param);
1610         }
1611 }