src/Model/User.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2021, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Model;
  23
  24 use DivineOmega\DOFileCachePSR6\CacheItemPool;
  25 use DivineOmega\PasswordExposed;
  26 use ErrorException;
  27 use Exception;
  28 use Friendica\Content\Pager;
  29 use Friendica\Core\Hook;
  30 use Friendica\Core\L10n;
  31 use Friendica\Core\Logger;
  32 use Friendica\Core\Protocol;
  33 use Friendica\Core\System;
  34 use Friendica\Core\Worker;
  35 use Friendica\Database\DBA;
  36 use Friendica\DI;
  37 use Friendica\Security\TwoFactor\Model\AppSpecificPassword;
  38 use Friendica\Network\HTTPException;
  39 use Friendica\Object\Image;
  40 use Friendica\Util\Crypto;
  41 use Friendica\Util\DateTimeFormat;
  42 use Friendica\Util\Images;
  43 use Friendica\Util\Network;
  44 use Friendica\Util\Proxy;
  45 use Friendica\Util\Strings;
  46 use Friendica\Worker\Delivery;
  47 use ImagickException;
  48 use LightOpenID;
  49
  50 /**
  51  * This class handles User related functions
  52  */
  53 class User
  54 {
  55         /**
  56          * Page/profile types
  57          *
  58          * PAGE_FLAGS_NORMAL is a typical personal profile account
  59          * PAGE_FLAGS_SOAPBOX automatically approves all friend requests as Contact::SHARING, (readonly)
  60          * PAGE_FLAGS_COMMUNITY automatically approves all friend requests as Contact::SHARING, but with
  61          *      write access to wall and comments (no email and not included in page owner's ACL lists)
  62          * PAGE_FLAGS_FREELOVE automatically approves all friend requests as full friends (Contact::FRIEND).
  63          *
  64          * @{
  65          */
  66         const PAGE_FLAGS_NORMAL    = 0;
  67         const PAGE_FLAGS_SOAPBOX   = 1;
  68         const PAGE_FLAGS_COMMUNITY = 2;
  69         const PAGE_FLAGS_FREELOVE  = 3;
  70         const PAGE_FLAGS_BLOG      = 4;
  71         const PAGE_FLAGS_PRVGROUP  = 5;
  72         /**
  73          * @}
  74          */
  75
  76         /**
  77          * Account types
  78          *
  79          * ACCOUNT_TYPE_PERSON - the account belongs to a person
  80          *      Associated page types: PAGE_FLAGS_NORMAL, PAGE_FLAGS_SOAPBOX, PAGE_FLAGS_FREELOVE
  81          *
  82          * ACCOUNT_TYPE_ORGANISATION - the account belongs to an organisation
  83          *      Associated page type: PAGE_FLAGS_SOAPBOX
  84          *
  85          * ACCOUNT_TYPE_NEWS - the account is a news reflector
  86          *      Associated page type: PAGE_FLAGS_SOAPBOX
  87          *
  88          * ACCOUNT_TYPE_COMMUNITY - the account is community forum
  89          *      Associated page types: PAGE_COMMUNITY, PAGE_FLAGS_PRVGROUP
  90          *
  91          * ACCOUNT_TYPE_RELAY - the account is a relay
  92          *      This will only be assigned to contacts, not to user accounts
  93          * @{
  94          */
  95         const ACCOUNT_TYPE_PERSON =       0;
  96         const ACCOUNT_TYPE_ORGANISATION = 1;
  97         const ACCOUNT_TYPE_NEWS =         2;
  98         const ACCOUNT_TYPE_COMMUNITY =    3;
  99         const ACCOUNT_TYPE_RELAY =        4;
 100         const ACCOUNT_TYPE_DELETED =    127;
 101         /**
 102          * @}
 103          */
 104
 105         private static $owner;
 106
 107         /**
 108          * Returns the numeric account type by their string
 109          *
 110          * @param string $accounttype as string constant
 111          * @return int|null Numeric account type - or null when not set
 112          */
 113         public static function getAccountTypeByString(string $accounttype)
 114         {
 115                 switch ($accounttype) {
 116                         case 'person':
 117                                 return User::ACCOUNT_TYPE_PERSON;
 118                         case 'organisation':
 119                                 return User::ACCOUNT_TYPE_ORGANISATION;
 120                         case 'news':
 121                                 return User::ACCOUNT_TYPE_NEWS;
 122                         case 'community':
 123                                 return User::ACCOUNT_TYPE_COMMUNITY;
 124                         default:
 125                                 return null;
 126                         break;
 127                 }
 128         }
 129
 130         /**
 131          * Fetch the system account
 132          *
 133          * @return array system account
 134          */
 135         public static function getSystemAccount()
 136         {
 137                 $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 138                 if (!DBA::isResult($system)) {
 139                         self::createSystemAccount();
 140                         $system = Contact::selectFirst([], ['self' => true, 'uid' => 0]);
 141                         if (!DBA::isResult($system)) {
 142                                 return [];
 143                         }
 144                 }
 145
 146                 $system['sprvkey'] = $system['uprvkey'] = $system['prvkey'];
 147                 $system['spubkey'] = $system['upubkey'] = $system['pubkey'];
 148                 $system['nickname'] = $system['nick'];
 149                 $system['page-flags'] = User::PAGE_FLAGS_SOAPBOX;
 150                 $system['account-type'] = $system['contact-type'];
 151                 $system['guid'] = '';
 152                 $system['nickname'] = $system['nick'];
 153                 $system['pubkey'] = $system['pubkey'];
 154                 $system['locality'] = '';
 155                 $system['region'] = '';
 156                 $system['country-name'] = '';
 157                 $system['net-publish'] = false;
 158
 159                 // Ensure that the user contains data
 160                 $user = DBA::selectFirst('user', ['prvkey'], ['uid' => 0]);
 161                 if (empty($user['prvkey'])) {
 162                         $fields = [
 163                                 'username' => $system['name'],
 164                                 'nickname' => $system['nick'],
 165                                 'register_date' => $system['created'],
 166                                 'pubkey' => $system['pubkey'],
 167                                 'prvkey' => $system['prvkey'],
 168                                 'spubkey' => $system['spubkey'],
 169                                 'sprvkey' => $system['sprvkey'],
 170                                 'verified' => true,
 171                                 'page-flags' => User::PAGE_FLAGS_SOAPBOX,
 172                                 'account-type' => User::ACCOUNT_TYPE_RELAY,
 173                         ];
 174
 175                         DBA::update('user', $fields, ['uid' => 0]);
 176                 }
 177
 178                 return $system;
 179         }
 180
 181         /**
 182          * Create the system account
 183          *
 184          * @return void
 185          */
 186         private static function createSystemAccount()
 187         {
 188                 $system_actor_name = self::getActorName();
 189                 if (empty($system_actor_name)) {
 190                         return;
 191                 }
 192
 193                 $keys = Crypto::newKeypair(4096);
 194                 if ($keys === false) {
 195                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 196                 }
 197
 198                 $system = [];
 199                 $system['uid'] = 0;
 200                 $system['created'] = DateTimeFormat::utcNow();
 201                 $system['self'] = true;
 202                 $system['network'] = Protocol::ACTIVITYPUB;
 203                 $system['name'] = 'System Account';
 204                 $system['addr'] = $system_actor_name . '@' . DI::baseUrl()->getHostname();
 205                 $system['nick'] = $system_actor_name;
 206                 $system['url'] = DI::baseUrl() . '/friendica';
 207
 208                 $system['avatar'] = $system['photo'] = Contact::getDefaultAvatar($system, Proxy::SIZE_SMALL);
 209                 $system['thumb'] = Contact::getDefaultAvatar($system, Proxy::SIZE_THUMB);
 210                 $system['micro'] = Contact::getDefaultAvatar($system, Proxy::SIZE_MICRO);
 211
 212                 $system['nurl'] = Strings::normaliseLink($system['url']);
 213                 $system['pubkey'] = $keys['pubkey'];
 214                 $system['prvkey'] = $keys['prvkey'];
 215                 $system['blocked'] = 0;
 216                 $system['pending'] = 0;
 217                 $system['contact-type'] = Contact::TYPE_RELAY; // In AP this is translated to 'Application'
 218                 $system['name-date'] = DateTimeFormat::utcNow();
 219                 $system['uri-date'] = DateTimeFormat::utcNow();
 220                 $system['avatar-date'] = DateTimeFormat::utcNow();
 221                 $system['closeness'] = 0;
 222                 $system['baseurl'] = DI::baseUrl();
 223                 $system['gsid'] = GServer::getID($system['baseurl']);
 224                 DBA::insert('contact', $system);
 225         }
 226
 227         /**
 228          * Detect a usable actor name
 229          *
 230          * @return string actor account name
 231          */
 232         public static function getActorName()
 233         {
 234                 $system_actor_name = DI::config()->get('system', 'actor_name');
 235                 if (!empty($system_actor_name)) {
 236                         $self = Contact::selectFirst(['nick'], ['uid' => 0, 'self' => true]);
 237                         if (!empty($self['nick'])) {
 238                                 if ($self['nick'] != $system_actor_name) {
 239                                         // Reset the actor name to the already used name
 240                                         DI::config()->set('system', 'actor_name', $self['nick']);
 241                                         $system_actor_name = $self['nick'];
 242                                 }
 243                         }
 244                         return $system_actor_name;
 245                 }
 246
 247                 // List of possible actor names
 248                 $possible_accounts = ['friendica', 'actor', 'system', 'internal'];
 249                 foreach ($possible_accounts as $name) {
 250                         if (!DBA::exists('user', ['nickname' => $name, 'account_removed' => false, 'expire' => false]) &&
 251                                 !DBA::exists('userd', ['username' => $name])) {
 252                                 DI::config()->set('system', 'actor_name', $name);
 253                                 return $name;
 254                         }
 255                 }
 256                 return '';
 257         }
 258
 259         /**
 260          * Returns true if a user record exists with the provided id
 261          *
 262          * @param  integer $uid
 263          * @return boolean
 264          * @throws Exception
 265          */
 266         public static function exists($uid)
 267         {
 268                 return DBA::exists('user', ['uid' => $uid]);
 269         }
 270
 271         /**
 272          * @param  integer       $uid
 273          * @param array          $fields
 274          * @return array|boolean User record if it exists, false otherwise
 275          * @throws Exception
 276          */
 277         public static function getById($uid, array $fields = [])
 278         {
 279                 return !empty($uid) ? DBA::selectFirst('user', $fields, ['uid' => $uid]) : [];
 280         }
 281
 282         /**
 283          * Returns a user record based on it's GUID
 284          *
 285          * @param string $guid   The guid of the user
 286          * @param array  $fields The fields to retrieve
 287          * @param bool   $active True, if only active records are searched
 288          *
 289          * @return array|boolean User record if it exists, false otherwise
 290          * @throws Exception
 291          */
 292         public static function getByGuid(string $guid, array $fields = [], bool $active = true)
 293         {
 294                 if ($active) {
 295                         $cond = ['guid' => $guid, 'account_expired' => false, 'account_removed' => false];
 296                 } else {
 297                         $cond = ['guid' => $guid];
 298                 }
 299
 300                 return DBA::selectFirst('user', $fields, $cond);
 301         }
 302
 303         /**
 304          * @param  string        $nickname
 305          * @param array          $fields
 306          * @return array|boolean User record if it exists, false otherwise
 307          * @throws Exception
 308          */
 309         public static function getByNickname($nickname, array $fields = [])
 310         {
 311                 return DBA::selectFirst('user', $fields, ['nickname' => $nickname]);
 312         }
 313
 314         /**
 315          * Returns the user id of a given profile URL
 316          *
 317          * @param string $url
 318          *
 319          * @return integer user id
 320          * @throws Exception
 321          */
 322         public static function getIdForURL(string $url)
 323         {
 324                 // Avoid database queries when the local node hostname isn't even part of the url.
 325                 if (!Contact::isLocal($url)) {
 326                         return 0;
 327                 }
 328
 329                 $self = Contact::selectFirst(['uid'], ['self' => true, 'nurl' => Strings::normaliseLink($url)]);
 330                 if (!empty($self['uid'])) {
 331                         return $self['uid'];
 332                 }
 333
 334                 $self = Contact::selectFirst(['uid'], ['self' => true, 'addr' => $url]);
 335                 if (!empty($self['uid'])) {
 336                         return $self['uid'];
 337                 }
 338
 339                 $self = Contact::selectFirst(['uid'], ['self' => true, 'alias' => [$url, Strings::normaliseLink($url)]]);
 340                 if (!empty($self['uid'])) {
 341                         return $self['uid'];
 342                 }
 343
 344                 return 0;
 345         }
 346
 347         /**
 348          * Get a user based on its email
 349          *
 350          * @param string        $email
 351          * @param array          $fields
 352          *
 353          * @return array|boolean User record if it exists, false otherwise
 354          *
 355          * @throws Exception
 356          */
 357         public static function getByEmail($email, array $fields = [])
 358         {
 359                 return DBA::selectFirst('user', $fields, ['email' => $email]);
 360         }
 361
 362         /**
 363          * Fetch the user array of the administrator. The first one if there are several.
 364          *
 365          * @param array $fields
 366          * @return array user
 367          */
 368         public static function getFirstAdmin(array $fields = [])
 369         {
 370                 if (!empty(DI::config()->get('config', 'admin_nickname'))) {
 371                         return self::getByNickname(DI::config()->get('config', 'admin_nickname'), $fields);
 372                 } elseif (!empty(DI::config()->get('config', 'admin_email'))) {
 373                         $adminList = explode(',', str_replace(' ', '', DI::config()->get('config', 'admin_email')));
 374                         return self::getByEmail($adminList[0], $fields);
 375                 } else {
 376                         return [];
 377                 }
 378         }
 379
 380         /**
 381          * Get owner data by user id
 382          *
 383          * @param int     $uid
 384          * @param boolean $repairMissing Repair the owner data if it's missing
 385          * @return boolean|array
 386          * @throws Exception
 387          */
 388         public static function getOwnerDataById(int $uid, bool $repairMissing = true)
 389         {
 390                 if ($uid == 0) {
 391                         return self::getSystemAccount();
 392                 }
 393
 394                 if (!empty(self::$owner[$uid])) {
 395                         return self::$owner[$uid];
 396                 }
 397
 398                 $owner = DBA::selectFirst('owner-view', [], ['uid' => $uid]);
 399                 if (!DBA::isResult($owner)) {
 400                         if (!DBA::exists('user', ['uid' => $uid]) || !$repairMissing) {
 401                                 return false;
 402                         }
 403                         if (!DBA::exists('profile', ['uid' => $uid])) {
 404                                 DBA::insert('profile', ['uid' => $uid]);
 405                         }
 406                         if (!DBA::exists('contact', ['uid' => $uid, 'self' => true])) {
 407                                 Contact::createSelfFromUserId($uid);
 408                         }
 409                         $owner = self::getOwnerDataById($uid, false);
 410                 }
 411
 412                 if (empty($owner['nickname'])) {
 413                         return false;
 414                 }
 415
 416                 if (!$repairMissing || $owner['account_expired']) {
 417                         return $owner;
 418                 }
 419
 420                 // Check if the returned data is valid, otherwise fix it. See issue #6122
 421
 422                 // Check for correct url and normalised nurl
 423                 $url = DI::baseUrl() . '/profile/' . $owner['nickname'];
 424                 $repair = empty($owner['network']) || ($owner['url'] != $url) || ($owner['nurl'] != Strings::normaliseLink($owner['url']));
 425
 426                 if (!$repair) {
 427                         // Check if "addr" is present and correct
 428                         $addr = $owner['nickname'] . '@' . substr(DI::baseUrl(), strpos(DI::baseUrl(), '://') + 3);
 429                         $repair = ($addr != $owner['addr']) || empty($owner['prvkey']) || empty($owner['pubkey']);
 430                 }
 431
 432                 if (!$repair) {
 433                         // Check if the avatar field is filled and the photo directs to the correct path
 434                         $avatar = Photo::selectFirst(['resource-id'], ['uid' => $uid, 'profile' => true]);
 435                         if (DBA::isResult($avatar)) {
 436                                 $repair = empty($owner['avatar']) || !strpos($owner['photo'], $avatar['resource-id']);
 437                         }
 438                 }
 439
 440                 if ($repair) {
 441                         Contact::updateSelfFromUserID($uid);
 442                         // Return the corrected data and avoid a loop
 443                         $owner = self::getOwnerDataById($uid, false);
 444                 }
 445
 446                 self::$owner[$uid] = $owner;
 447                 return $owner;
 448         }
 449
 450         /**
 451          * Get owner data by nick name
 452          *
 453          * @param int $nick
 454          * @return boolean|array
 455          * @throws Exception
 456          */
 457         public static function getOwnerDataByNick($nick)
 458         {
 459                 $user = DBA::selectFirst('user', ['uid'], ['nickname' => $nick]);
 460
 461                 if (!DBA::isResult($user)) {
 462                         return false;
 463                 }
 464
 465                 return self::getOwnerDataById($user['uid']);
 466         }
 467
 468         /**
 469          * Returns the default group for a given user and network
 470          *
 471          * @param int    $uid     User id
 472          * @param string $network network name
 473          *
 474          * @return int group id
 475          * @throws Exception
 476          */
 477         public static function getDefaultGroup($uid, $network = '')
 478         {
 479                 $user = DBA::selectFirst('user', ['def_gid'], ['uid' => $uid]);
 480                 if (DBA::isResult($user)) {
 481                         $default_group = $user["def_gid"];
 482                 } else {
 483                         $default_group = 0;
 484                 }
 485
 486                 return $default_group;
 487         }
 488
 489
 490         /**
 491          * Authenticate a user with a clear text password
 492          *
 493          * @param mixed  $user_info
 494          * @param string $password
 495          * @param bool   $third_party
 496          * @return int|boolean
 497          * @deprecated since version 3.6
 498          * @see        User::getIdFromPasswordAuthentication()
 499          */
 500         public static function authenticate($user_info, $password, $third_party = false)
 501         {
 502                 try {
 503                         return self::getIdFromPasswordAuthentication($user_info, $password, $third_party);
 504                 } catch (Exception $ex) {
 505                         return false;
 506                 }
 507         }
 508
 509         /**
 510          * Authenticate a user with a clear text password
 511          *
 512          * Returns the user id associated with a successful password authentication
 513          *
 514          * @param mixed  $user_info
 515          * @param string $password
 516          * @param bool   $third_party
 517          * @return int User Id if authentication is successful
 518          * @throws HTTPException\ForbiddenException
 519          * @throws HTTPException\NotFoundException
 520          */
 521         public static function getIdFromPasswordAuthentication($user_info, $password, $third_party = false)
 522         {
 523                 // Addons registered with the "authenticate" hook may create the user on the
 524                 // fly. `getAuthenticationInfo` will fail if the user doesn't exist yet. If
 525                 // the user doesn't exist, we should give the addons a chance to create the
 526                 // user in our database, if applicable, before re-throwing the exception if
 527                 // they fail.
 528                 try {
 529                         $user = self::getAuthenticationInfo($user_info);
 530                 } catch (Exception $e) {
 531                         $username = (is_string($user_info) ? $user_info : $user_info['nickname'] ?? '');
 532
 533                         // Addons can create users, and since this 'catch' branch should only
 534                         // execute if getAuthenticationInfo can't find an existing user, that's
 535                         // exactly what will happen here. Creating a numeric username would create
 536                         // abiguity with user IDs, possibly opening up an attack vector.
 537                         // So let's be very careful about that.
 538                         if (empty($username) || is_numeric($username)) {
 539                                 throw $e;
 540                         }
 541
 542                         return self::getIdFromAuthenticateHooks($username, $password);
 543                 }
 544
 545                 if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) {
 546                         // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead
 547                         if (AppSpecificPassword::authenticateUser($user['uid'], $password)) {
 548                                 return $user['uid'];
 549                         }
 550                 } elseif (strpos($user['password'], '$') === false) {
 551                         //Legacy hash that has not been replaced by a new hash yet
 552                         if (self::hashPasswordLegacy($password) === $user['password']) {
 553                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 554
 555                                 return $user['uid'];
 556                         }
 557                 } elseif (!empty($user['legacy_password'])) {
 558                         //Legacy hash that has been double-hashed and not replaced by a new hash yet
 559                         //Warning: `legacy_password` is not necessary in sync with the content of `password`
 560                         if (password_verify(self::hashPasswordLegacy($password), $user['password'])) {
 561                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 562
 563                                 return $user['uid'];
 564                         }
 565                 } elseif (password_verify($password, $user['password'])) {
 566                         //New password hash
 567                         if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
 568                                 self::updatePasswordHashed($user['uid'], self::hashPassword($password));
 569                         }
 570
 571                         return $user['uid'];
 572                 } else {
 573                         return self::getIdFromAuthenticateHooks($user['nickname'], $password); // throws
 574                 }
 575
 576                 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
 577         }
 578
 579         /**
 580          * Try to obtain a user ID via "authenticate" hook addons
 581          *
 582          * Returns the user id associated with a successful password authentication
 583          *
 584          * @param string $username
 585          * @param string $password
 586          * @return int User Id if authentication is successful
 587          * @throws HTTPException\ForbiddenException
 588          */
 589         public static function getIdFromAuthenticateHooks($username, $password)
 590         {
 591                 $addon_auth = [
 592                         'username'      => $username,
 593                         'password'      => $password,
 594                         'authenticated' => 0,
 595                         'user_record'   => null
 596                 ];
 597
 598                 /*
 599                  * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
 600                  * Addons should never set 'authenticated' except to indicate success - as hooks may be chained
 601                  * and later addons should not interfere with an earlier one that succeeded.
 602                  */
 603                 Hook::callAll('authenticate', $addon_auth);
 604
 605                 if ($addon_auth['authenticated'] && $addon_auth['user_record']) {
 606                         return $addon_auth['user_record']['uid'];
 607                 }
 608
 609                 throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
 610         }
 611
 612         /**
 613          * Returns authentication info from various parameters types
 614          *
 615          * User info can be any of the following:
 616          * - User DB object
 617          * - User Id
 618          * - User email or username or nickname
 619          * - User array with at least the uid and the hashed password
 620          *
 621          * @param mixed $user_info
 622          * @return array
 623          * @throws HTTPException\NotFoundException
 624          */
 625         public static function getAuthenticationInfo($user_info)
 626         {
 627                 $user = null;
 628
 629                 if (is_object($user_info) || is_array($user_info)) {
 630                         if (is_object($user_info)) {
 631                                 $user = (array) $user_info;
 632                         } else {
 633                                 $user = $user_info;
 634                         }
 635
 636                         if (
 637                                 !isset($user['uid'])
 638                                 || !isset($user['password'])
 639                                 || !isset($user['legacy_password'])
 640                         ) {
 641                                 throw new Exception(DI::l10n()->t('Not enough information to authenticate'));
 642                         }
 643                 } elseif (is_int($user_info) || is_string($user_info)) {
 644                         if (is_int($user_info)) {
 645                                 $user = DBA::selectFirst(
 646                                         'user',
 647                                         ['uid', 'nickname', 'password', 'legacy_password'],
 648                                         [
 649                                                 'uid' => $user_info,
 650                                                 'blocked' => 0,
 651                                                 'account_expired' => 0,
 652                                                 'account_removed' => 0,
 653                                                 'verified' => 1
 654                                         ]
 655                                 );
 656                         } else {
 657                                 $fields = ['uid', 'nickname', 'password', 'legacy_password'];
 658                                 $condition = [
 659                                         "(`email` = ? OR `username` = ? OR `nickname` = ?)
 660                                         AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
 661                                         $user_info, $user_info, $user_info
 662                                 ];
 663                                 $user = DBA::selectFirst('user', $fields, $condition);
 664                         }
 665
 666                         if (!DBA::isResult($user)) {
 667                                 throw new HTTPException\NotFoundException(DI::l10n()->t('User not found'));
 668                         }
 669                 }
 670
 671                 return $user;
 672         }
 673
 674         /**
 675          * Generates a human-readable random password
 676          *
 677          * @return string
 678          * @throws Exception
 679          */
 680         public static function generateNewPassword()
 681         {
 682                 return ucfirst(Strings::getRandomName(8)) . random_int(1000, 9999);
 683         }
 684
 685         /**
 686          * Checks if the provided plaintext password has been exposed or not
 687          *
 688          * @param string $password
 689          * @return bool
 690          * @throws Exception
 691          */
 692         public static function isPasswordExposed($password)
 693         {
 694                 $cache = new CacheItemPool();
 695                 $cache->changeConfig([
 696                         'cacheDirectory' => get_temppath() . '/password-exposed-cache/',
 697                 ]);
 698
 699                 try {
 700                         $passwordExposedChecker = new PasswordExposed\PasswordExposedChecker(null, $cache);
 701
 702                         return $passwordExposedChecker->passwordExposed($password) === PasswordExposed\PasswordStatus::EXPOSED;
 703                 } catch (Exception $e) {
 704                         Logger::error('Password Exposed Exception: ' . $e->getMessage(), [
 705                                 'code' => $e->getCode(),
 706                                 'file' => $e->getFile(),
 707                                 'line' => $e->getLine(),
 708                                 'trace' => $e->getTraceAsString()
 709                         ]);
 710
 711                         return false;
 712                 }
 713         }
 714
 715         /**
 716          * Legacy hashing function, kept for password migration purposes
 717          *
 718          * @param string $password
 719          * @return string
 720          */
 721         private static function hashPasswordLegacy($password)
 722         {
 723                 return hash('whirlpool', $password);
 724         }
 725
 726         /**
 727          * Global user password hashing function
 728          *
 729          * @param string $password
 730          * @return string
 731          * @throws Exception
 732          */
 733         public static function hashPassword($password)
 734         {
 735                 if (!trim($password)) {
 736                         throw new Exception(DI::l10n()->t('Password can\'t be empty'));
 737                 }
 738
 739                 return password_hash($password, PASSWORD_DEFAULT);
 740         }
 741
 742         /**
 743          * Updates a user row with a new plaintext password
 744          *
 745          * @param int    $uid
 746          * @param string $password
 747          * @return bool
 748          * @throws Exception
 749          */
 750         public static function updatePassword($uid, $password)
 751         {
 752                 $password = trim($password);
 753
 754                 if (empty($password)) {
 755                         throw new Exception(DI::l10n()->t('Empty passwords are not allowed.'));
 756                 }
 757
 758                 if (!DI::config()->get('system', 'disable_password_exposed', false) && self::isPasswordExposed($password)) {
 759                         throw new Exception(DI::l10n()->t('The new password has been exposed in a public data dump, please choose another.'));
 760                 }
 761
 762                 $allowed_characters = '!"#$%&\'()*+,-./;<=>?@[\]^_`{|}~';
 763
 764                 if (!preg_match('/^[a-z0-9' . preg_quote($allowed_characters, '/') . ']+$/i', $password)) {
 765                         throw new Exception(DI::l10n()->t('The password can\'t contain accentuated letters, white spaces or colons (:)'));
 766                 }
 767
 768                 return self::updatePasswordHashed($uid, self::hashPassword($password));
 769         }
 770
 771         /**
 772          * Updates a user row with a new hashed password.
 773          * Empties the password reset token field just in case.
 774          *
 775          * @param int    $uid
 776          * @param string $pasword_hashed
 777          * @return bool
 778          * @throws Exception
 779          */
 780         private static function updatePasswordHashed($uid, $pasword_hashed)
 781         {
 782                 $fields = [
 783                         'password' => $pasword_hashed,
 784                         'pwdreset' => null,
 785                         'pwdreset_time' => null,
 786                         'legacy_password' => false
 787                 ];
 788                 return DBA::update('user', $fields, ['uid' => $uid]);
 789         }
 790
 791         /**
 792          * Checks if a nickname is in the list of the forbidden nicknames
 793          *
 794          * Check if a nickname is forbidden from registration on the node by the
 795          * admin. Forbidden nicknames (e.g. role namess) can be configured in the
 796          * admin panel.
 797          *
 798          * @param string $nickname The nickname that should be checked
 799          * @return boolean True is the nickname is blocked on the node
 800          */
 801         public static function isNicknameBlocked($nickname)
 802         {
 803                 $forbidden_nicknames = DI::config()->get('system', 'forbidden_nicknames', '');
 804                 if (!empty($forbidden_nicknames)) {
 805                         $forbidden = explode(',', $forbidden_nicknames);
 806                         $forbidden = array_map('trim', $forbidden);
 807                 } else {
 808                         $forbidden = [];
 809                 }
 810
 811                 // Add the name of the internal actor to the "forbidden" list
 812                 $actor_name = self::getActorName();
 813                 if (!empty($actor_name)) {
 814                         $forbidden[] = $actor_name;
 815                 }
 816
 817                 if (empty($forbidden)) {
 818                         return false;
 819                 }
 820
 821                 // check if the nickname is in the list of blocked nicknames
 822                 if (in_array(strtolower($nickname), $forbidden)) {
 823                         return true;
 824                 }
 825
 826                 // else return false
 827                 return false;
 828         }
 829
 830         /**
 831          * Catch-all user creation function
 832          *
 833          * Creates a user from the provided data array, either form fields or OpenID.
 834          * Required: { username, nickname, email } or { openid_url }
 835          *
 836          * Performs the following:
 837          * - Sends to the OpenId auth URL (if relevant)
 838          * - Creates new key pairs for crypto
 839          * - Create self-contact
 840          * - Create profile image
 841          *
 842          * @param  array $data
 843          * @return array
 844          * @throws ErrorException
 845          * @throws HTTPException\InternalServerErrorException
 846          * @throws ImagickException
 847          * @throws Exception
 848          */
 849         public static function create(array $data)
 850         {
 851                 $return = ['user' => null, 'password' => ''];
 852
 853                 $using_invites = DI::config()->get('system', 'invitation_only');
 854
 855                 $invite_id  = !empty($data['invite_id'])  ? Strings::escapeTags(trim($data['invite_id']))  : '';
 856                 $username   = !empty($data['username'])   ? Strings::escapeTags(trim($data['username']))   : '';
 857                 $nickname   = !empty($data['nickname'])   ? Strings::escapeTags(trim($data['nickname']))   : '';
 858                 $email      = !empty($data['email'])      ? Strings::escapeTags(trim($data['email']))      : '';
 859                 $openid_url = !empty($data['openid_url']) ? Strings::escapeTags(trim($data['openid_url'])) : '';
 860                 $photo      = !empty($data['photo'])      ? Strings::escapeTags(trim($data['photo']))      : '';
 861                 $password   = !empty($data['password'])   ? trim($data['password'])           : '';
 862                 $password1  = !empty($data['password1'])  ? trim($data['password1'])          : '';
 863                 $confirm    = !empty($data['confirm'])    ? trim($data['confirm'])            : '';
 864                 $blocked    = !empty($data['blocked']);
 865                 $verified   = !empty($data['verified']);
 866                 $language   = !empty($data['language'])   ? Strings::escapeTags(trim($data['language']))   : 'en';
 867
 868                 $netpublish = $publish = !empty($data['profile_publish_reg']);
 869
 870                 if ($password1 != $confirm) {
 871                         throw new Exception(DI::l10n()->t('Passwords do not match. Password unchanged.'));
 872                 } elseif ($password1 != '') {
 873                         $password = $password1;
 874                 }
 875
 876                 if ($using_invites) {
 877                         if (!$invite_id) {
 878                                 throw new Exception(DI::l10n()->t('An invitation is required.'));
 879                         }
 880
 881                         if (!Register::existsByHash($invite_id)) {
 882                                 throw new Exception(DI::l10n()->t('Invitation could not be verified.'));
 883                         }
 884                 }
 885
 886                 /// @todo Check if this part is really needed. We should have fetched all this data in advance
 887                 if (empty($username) || empty($email) || empty($nickname)) {
 888                         if ($openid_url) {
 889                                 if (!Network::isUrlValid($openid_url)) {
 890                                         throw new Exception(DI::l10n()->t('Invalid OpenID url'));
 891                                 }
 892                                 $_SESSION['register'] = 1;
 893                                 $_SESSION['openid'] = $openid_url;
 894
 895                                 $openid = new LightOpenID(DI::baseUrl()->getHostname());
 896                                 $openid->identity = $openid_url;
 897                                 $openid->returnUrl = DI::baseUrl() . '/openid';
 898                                 $openid->required = ['namePerson/friendly', 'contact/email', 'namePerson'];
 899                                 $openid->optional = ['namePerson/first', 'media/image/aspect11', 'media/image/default'];
 900                                 try {
 901                                         $authurl = $openid->authUrl();
 902                                 } catch (Exception $e) {
 903                                         throw new Exception(DI::l10n()->t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . EOL . EOL . DI::l10n()->t('The error message was:') . $e->getMessage(), 0, $e);
 904                                 }
 905                                 System::externalRedirect($authurl);
 906                                 // NOTREACHED
 907                         }
 908
 909                         throw new Exception(DI::l10n()->t('Please enter the required information.'));
 910                 }
 911
 912                 if (!Network::isUrlValid($openid_url)) {
 913                         $openid_url = '';
 914                 }
 915
 916                 // collapse multiple spaces in name
 917                 $username = preg_replace('/ +/', ' ', $username);
 918
 919                 $username_min_length = max(1, min(64, intval(DI::config()->get('system', 'username_min_length', 3))));
 920                 $username_max_length = max(1, min(64, intval(DI::config()->get('system', 'username_max_length', 48))));
 921
 922                 if ($username_min_length > $username_max_length) {
 923                         Logger::log(DI::l10n()->t('system.username_min_length (%s) and system.username_max_length (%s) are excluding each other, swapping values.', $username_min_length, $username_max_length), Logger::WARNING);
 924                         $tmp = $username_min_length;
 925                         $username_min_length = $username_max_length;
 926                         $username_max_length = $tmp;
 927                 }
 928
 929                 if (mb_strlen($username) < $username_min_length) {
 930                         throw new Exception(DI::l10n()->tt('Username should be at least %s character.', 'Username should be at least %s characters.', $username_min_length));
 931                 }
 932
 933                 if (mb_strlen($username) > $username_max_length) {
 934                         throw new Exception(DI::l10n()->tt('Username should be at most %s character.', 'Username should be at most %s characters.', $username_max_length));
 935                 }
 936
 937                 // So now we are just looking for a space in the full name.
 938                 $loose_reg = DI::config()->get('system', 'no_regfullname');
 939                 if (!$loose_reg) {
 940                         $username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
 941                         if (strpos($username, ' ') === false) {
 942                                 throw new Exception(DI::l10n()->t("That doesn't appear to be your full (First Last) name."));
 943                         }
 944                 }
 945
 946                 if (!Network::isEmailDomainAllowed($email)) {
 947                         throw new Exception(DI::l10n()->t('Your email domain is not among those allowed on this site.'));
 948                 }
 949
 950                 if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !Network::isEmailDomainValid($email)) {
 951                         throw new Exception(DI::l10n()->t('Not a valid email address.'));
 952                 }
 953                 if (self::isNicknameBlocked($nickname)) {
 954                         throw new Exception(DI::l10n()->t('The nickname was blocked from registration by the nodes admin.'));
 955                 }
 956
 957                 if (DI::config()->get('system', 'block_extended_register', false) && DBA::exists('user', ['email' => $email])) {
 958                         throw new Exception(DI::l10n()->t('Cannot use that email.'));
 959                 }
 960
 961                 // Disallow somebody creating an account using openid that uses the admin email address,
 962                 // since openid bypasses email verification. We'll allow it if there is not yet an admin account.
 963                 if (DI::config()->get('config', 'admin_email') && strlen($openid_url)) {
 964                         $adminlist = explode(',', str_replace(' ', '', strtolower(DI::config()->get('config', 'admin_email'))));
 965                         if (in_array(strtolower($email), $adminlist)) {
 966                                 throw new Exception(DI::l10n()->t('Cannot use that email.'));
 967                         }
 968                 }
 969
 970                 $nickname = $data['nickname'] = strtolower($nickname);
 971
 972                 if (!preg_match('/^[a-z0-9][a-z0-9_]*$/', $nickname)) {
 973                         throw new Exception(DI::l10n()->t('Your nickname can only contain a-z, 0-9 and _.'));
 974                 }
 975
 976                 // Check existing and deleted accounts for this nickname.
 977                 if (
 978                         DBA::exists('user', ['nickname' => $nickname])
 979                         || DBA::exists('userd', ['username' => $nickname])
 980                 ) {
 981                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
 982                 }
 983
 984                 $new_password = strlen($password) ? $password : User::generateNewPassword();
 985                 $new_password_encoded = self::hashPassword($new_password);
 986
 987                 $return['password'] = $new_password;
 988
 989                 $keys = Crypto::newKeypair(4096);
 990                 if ($keys === false) {
 991                         throw new Exception(DI::l10n()->t('SERIOUS ERROR: Generation of security keys failed.'));
 992                 }
 993
 994                 $prvkey = $keys['prvkey'];
 995                 $pubkey = $keys['pubkey'];
 996
 997                 // Create another keypair for signing/verifying salmon protocol messages.
 998                 $sres = Crypto::newKeypair(512);
 999                 $sprvkey = $sres['prvkey'];
1000                 $spubkey = $sres['pubkey'];
1001
1002                 $insert_result = DBA::insert('user', [
1003                         'guid'     => System::createUUID(),
1004                         'username' => $username,
1005                         'password' => $new_password_encoded,
1006                         'email'    => $email,
1007                         'openid'   => $openid_url,
1008                         'nickname' => $nickname,
1009                         'pubkey'   => $pubkey,
1010                         'prvkey'   => $prvkey,
1011                         'spubkey'  => $spubkey,
1012                         'sprvkey'  => $sprvkey,
1013                         'verified' => $verified,
1014                         'blocked'  => $blocked,
1015                         'language' => $language,
1016                         'timezone' => 'UTC',
1017                         'register_date' => DateTimeFormat::utcNow(),
1018                         'default-location' => ''
1019                 ]);
1020
1021                 if ($insert_result) {
1022                         $uid = DBA::lastInsertId();
1023                         $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1024                 } else {
1025                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1026                 }
1027
1028                 if (!$uid) {
1029                         throw new Exception(DI::l10n()->t('An error occurred during registration. Please try again.'));
1030                 }
1031
1032                 // if somebody clicked submit twice very quickly, they could end up with two accounts
1033                 // due to race condition. Remove this one.
1034                 $user_count = DBA::count('user', ['nickname' => $nickname]);
1035                 if ($user_count > 1) {
1036                         DBA::delete('user', ['uid' => $uid]);
1037
1038                         throw new Exception(DI::l10n()->t('Nickname is already registered. Please choose another.'));
1039                 }
1040
1041                 $insert_result = DBA::insert('profile', [
1042                         'uid' => $uid,
1043                         'name' => $username,
1044                         'photo' => DI::baseUrl() . "/photo/profile/{$uid}.jpg",
1045                         'thumb' => DI::baseUrl() . "/photo/avatar/{$uid}.jpg",
1046                         'publish' => $publish,
1047                         'net-publish' => $netpublish,
1048                 ]);
1049                 if (!$insert_result) {
1050                         DBA::delete('user', ['uid' => $uid]);
1051
1052                         throw new Exception(DI::l10n()->t('An error occurred creating your default profile. Please try again.'));
1053                 }
1054
1055                 // Create the self contact
1056                 if (!Contact::createSelfFromUserId($uid)) {
1057                         DBA::delete('user', ['uid' => $uid]);
1058
1059                         throw new Exception(DI::l10n()->t('An error occurred creating your self contact. Please try again.'));
1060                 }
1061
1062                 // Create a group with no members. This allows somebody to use it
1063                 // right away as a default group for new contacts.
1064                 $def_gid = Group::create($uid, DI::l10n()->t('Friends'));
1065                 if (!$def_gid) {
1066                         DBA::delete('user', ['uid' => $uid]);
1067
1068                         throw new Exception(DI::l10n()->t('An error occurred creating your default contact group. Please try again.'));
1069                 }
1070
1071                 $fields = ['def_gid' => $def_gid];
1072                 if (DI::config()->get('system', 'newuser_private') && $def_gid) {
1073                         $fields['allow_gid'] = '<' . $def_gid . '>';
1074                 }
1075
1076                 DBA::update('user', $fields, ['uid' => $uid]);
1077
1078                 // if we have no OpenID photo try to look up an avatar
1079                 if (!strlen($photo)) {
1080                         $photo = Network::lookupAvatarByEmail($email);
1081                 }
1082
1083                 // unless there is no avatar-addon loaded
1084                 if (strlen($photo)) {
1085                         $photo_failure = false;
1086
1087                         $filename = basename($photo);
1088                         $curlResult = DI::httpRequest()->get($photo);
1089                         if ($curlResult->isSuccess()) {
1090                                 $img_str = $curlResult->getBody();
1091                                 $type = $curlResult->getContentType();
1092                         } else {
1093                                 $img_str = '';
1094                                 $type = '';
1095                         }
1096
1097                         $type = Images::getMimeTypeByData($img_str, $photo, $type);
1098
1099                         $Image = new Image($img_str, $type);
1100                         if ($Image->isValid()) {
1101                                 $Image->scaleToSquare(300);
1102
1103                                 $resource_id = Photo::newResource();
1104
1105                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 4);
1106
1107                                 if ($r === false) {
1108                                         $photo_failure = true;
1109                                 }
1110
1111                                 $Image->scaleDown(80);
1112
1113                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 5);
1114
1115                                 if ($r === false) {
1116                                         $photo_failure = true;
1117                                 }
1118
1119                                 $Image->scaleDown(48);
1120
1121                                 $r = Photo::store($Image, $uid, 0, $resource_id, $filename, DI::l10n()->t('Profile Photos'), 6);
1122
1123                                 if ($r === false) {
1124                                         $photo_failure = true;
1125                                 }
1126
1127                                 if (!$photo_failure) {
1128                                         Photo::update(['profile' => 1], ['resource-id' => $resource_id]);
1129                                 }
1130                         }
1131
1132                         Contact::updateSelfFromUserID($uid, true);
1133                 }
1134
1135                 Hook::callAll('register_account', $uid);
1136
1137                 $return['user'] = $user;
1138                 return $return;
1139         }
1140
1141         /**
1142          * Update a user entry and distribute the changes if needed
1143          *
1144          * @param array $fields
1145          * @param integer $uid
1146          * @return boolean
1147          */
1148         public static function update(array $fields, int $uid): bool
1149         {
1150                 $old_owner = self::getOwnerDataById($uid);
1151                 if (empty($old_owner)) {
1152                         return false;
1153                 }
1154
1155                 if (!DBA::update('user', $fields, ['uid' => $uid])) {
1156                         return false;
1157                 }
1158
1159                 $update = Contact::updateSelfFromUserID($uid);
1160
1161                 $owner = self::getOwnerDataById($uid);
1162                 if (empty($owner)) {
1163                         return false;
1164                 }
1165
1166                 if ($old_owner['name'] != $owner['name']) {
1167                         Profile::update(['name' => $owner['name']], $uid);
1168                 }
1169
1170                 if ($update) {
1171                         Profile::publishUpdate($uid);
1172                 }
1173
1174                 return true;
1175         }
1176
1177         /**
1178          * Sets block state for a given user
1179          *
1180          * @param int  $uid   The user id
1181          * @param bool $block Block state (default is true)
1182          *
1183          * @return bool True, if successfully blocked
1184
1185          * @throws Exception
1186          */
1187         public static function block(int $uid, bool $block = true)
1188         {
1189                 return DBA::update('user', ['blocked' => $block], ['uid' => $uid]);
1190         }
1191
1192         /**
1193          * Allows a registration based on a hash
1194          *
1195          * @param string $hash
1196          *
1197          * @return bool True, if the allow was successful
1198          *
1199          * @throws HTTPException\InternalServerErrorException
1200          * @throws Exception
1201          */
1202         public static function allow(string $hash)
1203         {
1204                 $register = Register::getByHash($hash);
1205                 if (!DBA::isResult($register)) {
1206                         return false;
1207                 }
1208
1209                 $user = User::getById($register['uid']);
1210                 if (!DBA::isResult($user)) {
1211                         return false;
1212                 }
1213
1214                 Register::deleteByHash($hash);
1215
1216                 DBA::update('user', ['blocked' => false, 'verified' => true], ['uid' => $register['uid']]);
1217
1218                 $profile = DBA::selectFirst('profile', ['net-publish'], ['uid' => $register['uid']]);
1219
1220                 if (DBA::isResult($profile) && $profile['net-publish'] && DI::config()->get('system', 'directory')) {
1221                         $url = DI::baseUrl() . '/profile/' . $user['nickname'];
1222                         Worker::add(PRIORITY_LOW, "Directory", $url);
1223                 }
1224
1225                 $l10n = DI::l10n()->withLang($register['language']);
1226
1227                 return User::sendRegisterOpenEmail(
1228                         $l10n,
1229                         $user,
1230                         DI::config()->get('config', 'sitename'),
1231                         DI::baseUrl()->get(),
1232                         ($register['password'] ?? '') ?: 'Sent in a previous email'
1233                 );
1234         }
1235
1236         /**
1237          * Denys a pending registration
1238          *
1239          * @param string $hash The hash of the pending user
1240          *
1241          * This does not have to go through user_remove() and save the nickname
1242          * permanently against re-registration, as the person was not yet
1243          * allowed to have friends on this system
1244          *
1245          * @return bool True, if the deny was successfull
1246          * @throws Exception
1247          */
1248         public static function deny(string $hash)
1249         {
1250                 $register = Register::getByHash($hash);
1251                 if (!DBA::isResult($register)) {
1252                         return false;
1253                 }
1254
1255                 $user = User::getById($register['uid']);
1256                 if (!DBA::isResult($user)) {
1257                         return false;
1258                 }
1259
1260                 // Delete the avatar
1261                 Photo::delete(['uid' => $register['uid']]);
1262
1263                 return DBA::delete('user', ['uid' => $register['uid']]) &&
1264                        Register::deleteByHash($register['hash']);
1265         }
1266
1267         /**
1268          * Creates a new user based on a minimal set and sends an email to this user
1269          *
1270          * @param string $name  The user's name
1271          * @param string $email The user's email address
1272          * @param string $nick  The user's nick name
1273          * @param string $lang  The user's language (default is english)
1274          *
1275          * @return bool True, if the user was created successfully
1276          * @throws HTTPException\InternalServerErrorException
1277          * @throws ErrorException
1278          * @throws ImagickException
1279          */
1280         public static function createMinimal(string $name, string $email, string $nick, string $lang = L10n::DEFAULT)
1281         {
1282                 if (empty($name) ||
1283                     empty($email) ||
1284                     empty($nick)) {
1285                         throw new HTTPException\InternalServerErrorException('Invalid arguments.');
1286                 }
1287
1288                 $result = self::create([
1289                         'username' => $name,
1290                         'email' => $email,
1291                         'nickname' => $nick,
1292                         'verified' => 1,
1293                         'language' => $lang
1294                 ]);
1295
1296                 $user = $result['user'];
1297                 $preamble = Strings::deindent(DI::l10n()->t('
1298                 Dear %1$s,
1299                         the administrator of %2$s has set up an account for you.'));
1300                 $body = Strings::deindent(DI::l10n()->t('
1301                 The login details are as follows:
1302
1303                 Site Location:  %1$s
1304                 Login Name:             %2$s
1305                 Password:               %3$s
1306
1307                 You may change your password from your account "Settings" page after logging
1308                 in.
1309
1310                 Please take a few moments to review the other account settings on that page.
1311
1312                 You may also wish to add some basic information to your default profile
1313                 (on the "Profiles" page) so that other people can easily find you.
1314
1315                 We recommend setting your full name, adding a profile photo,
1316                 adding some profile "keywords" (very useful in making new friends) - and
1317                 perhaps what country you live in; if you do not wish to be more specific
1318                 than that.
1319
1320                 We fully respect your right to privacy, and none of these items are necessary.
1321                 If you are new and do not know anybody here, they may help
1322                 you to make some new and interesting friends.
1323
1324                 If you ever want to delete your account, you can do so at %1$s/removeme
1325
1326                 Thank you and welcome to %4$s.'));
1327
1328                 $preamble = sprintf($preamble, $user['username'], DI::config()->get('config', 'sitename'));
1329                 $body = sprintf($body, DI::baseUrl()->get(), $user['nickname'], $result['password'], DI::config()->get('config', 'sitename'));
1330
1331                 $email = DI::emailer()
1332                         ->newSystemMail()
1333                         ->withMessage(DI::l10n()->t('Registration details for %s', DI::config()->get('config', 'sitename')), $preamble, $body)
1334                         ->forUser($user)
1335                         ->withRecipient($user['email'])
1336                         ->build();
1337                 return DI::emailer()->send($email);
1338         }
1339
1340         /**
1341          * Sends pending registration confirmation email
1342          *
1343          * @param array  $user     User record array
1344          * @param string $sitename
1345          * @param string $siteurl
1346          * @param string $password Plaintext password
1347          * @return NULL|boolean from notification() and email() inherited
1348          * @throws HTTPException\InternalServerErrorException
1349          */
1350         public static function sendRegisterPendingEmail($user, $sitename, $siteurl, $password)
1351         {
1352                 $body = Strings::deindent(DI::l10n()->t(
1353                         '
1354                         Dear %1$s,
1355                                 Thank you for registering at %2$s. Your account is pending for approval by the administrator.
1356
1357                         Your login details are as follows:
1358
1359                         Site Location:  %3$s
1360                         Login Name:             %4$s
1361                         Password:               %5$s
1362                 ',
1363                         $user['username'],
1364                         $sitename,
1365                         $siteurl,
1366                         $user['nickname'],
1367                         $password
1368                 ));
1369
1370                 $email = DI::emailer()
1371                         ->newSystemMail()
1372                         ->withMessage(DI::l10n()->t('Registration at %s', $sitename), $body)
1373                         ->forUser($user)
1374                         ->withRecipient($user['email'])
1375                         ->build();
1376                 return DI::emailer()->send($email);
1377         }
1378
1379         /**
1380          * Sends registration confirmation
1381          *
1382          * It's here as a function because the mail is sent from different parts
1383          *
1384          * @param L10n   $l10n     The used language
1385          * @param array  $user     User record array
1386          * @param string $sitename
1387          * @param string $siteurl
1388          * @param string $password Plaintext password
1389          *
1390          * @return NULL|boolean from notification() and email() inherited
1391          * @throws HTTPException\InternalServerErrorException
1392          */
1393         public static function sendRegisterOpenEmail(L10n $l10n, $user, $sitename, $siteurl, $password)
1394         {
1395                 $preamble = Strings::deindent($l10n->t(
1396                         '
1397                                 Dear %1$s,
1398                                 Thank you for registering at %2$s. Your account has been created.
1399                         ',
1400                         $user['username'],
1401                         $sitename
1402                 ));
1403                 $body = Strings::deindent($l10n->t(
1404                         '
1405                         The login details are as follows:
1406
1407                         Site Location:  %3$s
1408                         Login Name:             %1$s
1409                         Password:               %5$s
1410
1411                         You may change your password from your account "Settings" page after logging
1412                         in.
1413
1414                         Please take a few moments to review the other account settings on that page.
1415
1416                         You may also wish to add some basic information to your default profile
1417                         ' . "\x28" . 'on the "Profiles" page' . "\x29" . ' so that other people can easily find you.
1418
1419                         We recommend setting your full name, adding a profile photo,
1420                         adding some profile "keywords" ' . "\x28" . 'very useful in making new friends' . "\x29" . ' - and
1421                         perhaps what country you live in; if you do not wish to be more specific
1422                         than that.
1423
1424                         We fully respect your right to privacy, and none of these items are necessary.
1425                         If you are new and do not know anybody here, they may help
1426                         you to make some new and interesting friends.
1427
1428                         If you ever want to delete your account, you can do so at %3$s/removeme
1429
1430                         Thank you and welcome to %2$s.',
1431                         $user['nickname'],
1432                         $sitename,
1433                         $siteurl,
1434                         $user['username'],
1435                         $password
1436                 ));
1437
1438                 $email = DI::emailer()
1439                         ->newSystemMail()
1440                         ->withMessage(DI::l10n()->t('Registration details for %s', $sitename), $preamble, $body)
1441                         ->forUser($user)
1442                         ->withRecipient($user['email'])
1443                         ->build();
1444                 return DI::emailer()->send($email);
1445         }
1446
1447         /**
1448          * @param int $uid user to remove
1449          * @return bool
1450          * @throws HTTPException\InternalServerErrorException
1451          */
1452         public static function remove(int $uid)
1453         {
1454                 if (empty($uid)) {
1455                         return false;
1456                 }
1457
1458                 Logger::log('Removing user: ' . $uid);
1459
1460                 $user = DBA::selectFirst('user', [], ['uid' => $uid]);
1461
1462                 Hook::callAll('remove_user', $user);
1463
1464                 // save username (actually the nickname as it is guaranteed
1465                 // unique), so it cannot be re-registered in the future.
1466                 DBA::insert('userd', ['username' => $user['nickname']]);
1467
1468                 // Remove all personal settings, especially connector settings
1469                 DBA::delete('pconfig', ['uid' => $uid]);
1470
1471                 // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
1472                 DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
1473                 Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);
1474
1475                 // Send an update to the directory
1476                 $self = DBA::selectFirst('contact', ['url'], ['uid' => $uid, 'self' => true]);
1477                 Worker::add(PRIORITY_LOW, 'Directory', $self['url']);
1478
1479                 // Remove the user relevant data
1480                 Worker::add(PRIORITY_NEGLIGIBLE, 'RemoveUser', $uid);
1481
1482                 return true;
1483         }
1484
1485         /**
1486          * Return all identities to a user
1487          *
1488          * @param int $uid The user id
1489          * @return array All identities for this user
1490          *
1491          * Example for a return:
1492          *    [
1493          *        [
1494          *            'uid' => 1,
1495          *            'username' => 'maxmuster',
1496          *            'nickname' => 'Max Mustermann'
1497          *        ],
1498          *        [
1499          *            'uid' => 2,
1500          *            'username' => 'johndoe',
1501          *            'nickname' => 'John Doe'
1502          *        ]
1503          *    ]
1504          * @throws Exception
1505          */
1506         public static function identities($uid)
1507         {
1508                 if (empty($uid)) {
1509                         return [];
1510                 }
1511
1512                 $identities = [];
1513
1514                 $user = DBA::selectFirst('user', ['uid', 'nickname', 'username', 'parent-uid'], ['uid' => $uid]);
1515                 if (!DBA::isResult($user)) {
1516                         return $identities;
1517                 }
1518
1519                 if ($user['parent-uid'] == 0) {
1520                         // First add our own entry
1521                         $identities = [[
1522                                 'uid' => $user['uid'],
1523                                 'username' => $user['username'],
1524                                 'nickname' => $user['nickname']
1525                         ]];
1526
1527                         // Then add all the children
1528                         $r = DBA::select(
1529                                 'user',
1530                                 ['uid', 'username', 'nickname'],
1531                                 ['parent-uid' => $user['uid'], 'account_removed' => false]
1532                         );
1533                         if (DBA::isResult($r)) {
1534                                 $identities = array_merge($identities, DBA::toArray($r));
1535                         }
1536                 } else {
1537                         // First entry is our parent
1538                         $r = DBA::select(
1539                                 'user',
1540                                 ['uid', 'username', 'nickname'],
1541                                 ['uid' => $user['parent-uid'], 'account_removed' => false]
1542                         );
1543                         if (DBA::isResult($r)) {
1544                                 $identities = DBA::toArray($r);
1545                         }
1546
1547                         // Then add all siblings
1548                         $r = DBA::select(
1549                                 'user',
1550                                 ['uid', 'username', 'nickname'],
1551                                 ['parent-uid' => $user['parent-uid'], 'account_removed' => false]
1552                         );
1553                         if (DBA::isResult($r)) {
1554                                 $identities = array_merge($identities, DBA::toArray($r));
1555                         }
1556                 }
1557
1558                 $r = DBA::p(
1559                         "SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
1560                         FROM `manage`
1561                         INNER JOIN `user` ON `manage`.`mid` = `user`.`uid`
1562                         WHERE `user`.`account_removed` = 0 AND `manage`.`uid` = ?",
1563                         $user['uid']
1564                 );
1565                 if (DBA::isResult($r)) {
1566                         $identities = array_merge($identities, DBA::toArray($r));
1567                 }
1568
1569                 return $identities;
1570         }
1571
1572         /**
1573          * Returns statistical information about the current users of this node
1574          *
1575          * @return array
1576          *
1577          * @throws Exception
1578          */
1579         public static function getStatistics()
1580         {
1581                 $statistics = [
1582                         'total_users'           => 0,
1583                         'active_users_halfyear' => 0,
1584                         'active_users_monthly'  => 0,
1585                         'active_users_weekly'   => 0,
1586                 ];
1587
1588                 $userStmt = DBA::select('owner-view', ['uid', 'login_date', 'last-item'],
1589                         ["`verified` AND `login_date` > ? AND NOT `blocked`
1590                         AND NOT `account_removed` AND NOT `account_expired`",
1591                         DBA::NULL_DATETIME]);
1592                 if (!DBA::isResult($userStmt)) {
1593                         return $statistics;
1594                 }
1595
1596                 $halfyear = time() - (180 * 24 * 60 * 60);
1597                 $month = time() - (30 * 24 * 60 * 60);
1598                 $week = time() - (7 * 24 * 60 * 60);
1599
1600                 while ($user = DBA::fetch($userStmt)) {
1601                         $statistics['total_users']++;
1602
1603                         if ((strtotime($user['login_date']) > $halfyear) || (strtotime($user['last-item']) > $halfyear)
1604                         ) {
1605                                 $statistics['active_users_halfyear']++;
1606                         }
1607
1608                         if ((strtotime($user['login_date']) > $month) || (strtotime($user['last-item']) > $month)
1609                         ) {
1610                                 $statistics['active_users_monthly']++;
1611                         }
1612
1613                         if ((strtotime($user['login_date']) > $week) || (strtotime($user['last-item']) > $week)
1614                         ) {
1615                                 $statistics['active_users_weekly']++;
1616                         }
1617                 }
1618                 DBA::close($userStmt);
1619
1620                 return $statistics;
1621         }
1622
1623         /**
1624          * Get all users of the current node
1625          *
1626          * @param int    $start Start count (Default is 0)
1627          * @param int    $count Count of the items per page (Default is @see Pager::ITEMS_PER_PAGE)
1628          * @param string $type  The type of users, which should get (all, bocked, removed)
1629          * @param string $order Order of the user list (Default is 'contact.name')
1630          * @param bool   $descending Order direction (Default is ascending)
1631          *
1632          * @return array The list of the users
1633          * @throws Exception
1634          */
1635         public static function getList($start = 0, $count = Pager::ITEMS_PER_PAGE, $type = 'all', $order = 'name', bool $descending = false)
1636         {
1637                 $param = ['limit' => [$start, $count], 'order' => [$order => $descending]];
1638                 $condition = [];
1639                 switch ($type) {
1640                         case 'active':
1641                                 $condition['account_removed'] = false;
1642                                 $condition['blocked'] = false;
1643                                 break;
1644                         case 'blocked':
1645                                 $condition['account_removed'] = false;
1646                                 $condition['blocked'] = true;
1647                                 $condition['verified'] = true;
1648                                 break;
1649                         case 'removed':
1650                                 $condition['account_removed'] = true;
1651                                 break;
1652                 }
1653
1654                 return DBA::selectToArray('owner-view', [], $condition, $param);
1655         }
1656 }