]> git.mxchange.org Git - friendica.git/blobdiff - mod/settings.php
Merge pull request #7186 from MrPetovan/bug/7183-archives-profile-widget
[friendica.git] / mod / settings.php
index d886288409a0ccef12495b8d7673e8a8d4e4750a..45f11cdb6c3f3ff89e69ad9899b986ca1e74bcb5 100644 (file)
@@ -8,8 +8,8 @@ use Friendica\BaseModule;
 use Friendica\Content\Feature;
 use Friendica\Content\Nav;
 use Friendica\Core\ACL;
-use Friendica\Core\Addon;
 use Friendica\Core\Config;
+use Friendica\Core\Hook;
 use Friendica\Core\L10n;
 use Friendica\Core\Logger;
 use Friendica\Core\PConfig;
@@ -25,11 +25,14 @@ use Friendica\Model\User;
 use Friendica\Module\Login;
 use Friendica\Protocol\Email;
 use Friendica\Util\Network;
+use Friendica\Util\Strings;
 use Friendica\Util\Temporal;
 
 function get_theme_config_file($theme)
 {
-       $a = get_app();
+       $theme = Strings::sanitizeFilePathItem($theme);
+
+       $a = \get_app();
        $base_theme = defaults($a->theme_info, 'extends');
 
        if (file_exists("view/theme/$theme/config.php")) {
@@ -64,6 +67,13 @@ function settings_init(App $a)
                ],
        ];
 
+       $tabs[] = [
+               'label' => L10n::t('Two-factor authentication'),
+               'url' => 'settings/2fa',
+               'selected' => (($a->argc > 1) && ($a->argv[1] === '2fa') ? 'active' : ''),
+               'accesskey' => 'o',
+       ];
+
        $tabs[] =       [
                'label' => L10n::t('Profiles'),
                'url'   => 'profiles',
@@ -145,18 +155,18 @@ function settings_post(App $a)
                return;
        }
 
-       if (x($_SESSION, 'submanage') && intval($_SESSION['submanage'])) {
+       if (!empty($_SESSION['submanage'])) {
                return;
        }
 
-       if (count($a->user) && x($a->user, 'uid') && $a->user['uid'] != local_user()) {
+       if (count($a->user) && !empty($a->user['uid']) && $a->user['uid'] != local_user()) {
                notice(L10n::t('Permission denied.') . EOL);
                return;
        }
 
        $old_page_flags = $a->user['page-flags'];
 
-       if (($a->argc > 1) && ($a->argv[1] === 'oauth') && x($_POST, 'remove')) {
+       if (($a->argc > 1) && ($a->argv[1] === 'oauth') && !empty($_POST['remove'])) {
                BaseModule::checkFormSecurityTokenRedirectOnError('/settings/oauth', 'settings_oauth');
 
                $key = $_POST['remove'];
@@ -165,7 +175,7 @@ function settings_post(App $a)
                return;
        }
 
-       if (($a->argc > 2) && ($a->argv[1] === 'oauth')  && ($a->argv[2] === 'edit'||($a->argv[2] === 'add')) && x($_POST, 'submit')) {
+       if (($a->argc > 2) && ($a->argv[1] === 'oauth')  && ($a->argv[2] === 'edit'||($a->argv[2] === 'add')) && !empty($_POST['submit'])) {
                BaseModule::checkFormSecurityTokenRedirectOnError('/settings/oauth', 'settings_oauth');
 
                $name     = defaults($_POST, 'name'    , '');
@@ -214,30 +224,30 @@ function settings_post(App $a)
        if (($a->argc > 1) && ($a->argv[1] == 'addon')) {
                BaseModule::checkFormSecurityTokenRedirectOnError('/settings/addon', 'settings_addon');
 
-               Addon::callHooks('addon_settings_post', $_POST);
+               Hook::callAll('addon_settings_post', $_POST);
                return;
        }
 
        if (($a->argc > 1) && ($a->argv[1] == 'connectors')) {
                BaseModule::checkFormSecurityTokenRedirectOnError('/settings/connectors', 'settings_connectors');
 
-               if (x($_POST, 'general-submit')) {
+               if (!empty($_POST['general-submit'])) {
                        PConfig::set(local_user(), 'system', 'disable_cw', intval($_POST['disable_cw']));
                        PConfig::set(local_user(), 'system', 'no_intelligent_shortening', intval($_POST['no_intelligent_shortening']));
                        PConfig::set(local_user(), 'system', 'ostatus_autofriend', intval($_POST['snautofollow']));
                        PConfig::set(local_user(), 'ostatus', 'default_group', $_POST['group-selection']);
                        PConfig::set(local_user(), 'ostatus', 'legacy_contact', $_POST['legacy_contact']);
-               } elseif (x($_POST, 'imap-submit')) {
+               } elseif (!empty($_POST['imap-submit'])) {
 
-                       $mail_server       = ((x($_POST, 'mail_server')) ? $_POST['mail_server'] : '');
-                       $mail_port         = ((x($_POST, 'mail_port')) ? $_POST['mail_port'] : '');
-                       $mail_ssl          = ((x($_POST, 'mail_ssl')) ? strtolower(trim($_POST['mail_ssl'])) : '');
-                       $mail_user         = ((x($_POST, 'mail_user')) ? $_POST['mail_user'] : '');
-                       $mail_pass         = ((x($_POST, 'mail_pass')) ? trim($_POST['mail_pass']) : '');
-                       $mail_action       = ((x($_POST, 'mail_action')) ? trim($_POST['mail_action']) : '');
-                       $mail_movetofolder = ((x($_POST, 'mail_movetofolder')) ? trim($_POST['mail_movetofolder']) : '');
-                       $mail_replyto      = ((x($_POST, 'mail_replyto')) ? $_POST['mail_replyto'] : '');
-                       $mail_pubmail      = ((x($_POST, 'mail_pubmail')) ? $_POST['mail_pubmail'] : '');
+                       $mail_server       = defaults($_POST, 'mail_server', '');
+                       $mail_port         = defaults($_POST, 'mail_port', '');
+                       $mail_ssl          = (!empty($_POST['mail_ssl']) ? strtolower(trim($_POST['mail_ssl'])) : '');
+                       $mail_user         = defaults($_POST, 'mail_user', '');
+                       $mail_pass         = (!empty($_POST['mail_pass']) ? trim($_POST['mail_pass']) : '');
+                       $mail_action       = (!empty($_POST['mail_action']) ? trim($_POST['mail_action']) : '');
+                       $mail_movetofolder = (!empty($_POST['mail_movetofolder']) ? trim($_POST['mail_movetofolder']) : '');
+                       $mail_replyto      = defaults($_POST, 'mail_replyto', '');
+                       $mail_pubmail      = defaults($_POST, 'mail_pubmail', '');
 
 
                        $mail_disabled = ((function_exists('imap_open') && (!Config::get('system', 'imap_disabled'))) ? 0 : 1);
@@ -296,7 +306,7 @@ function settings_post(App $a)
                        }
                }
 
-               Addon::callHooks('connector_settings_post', $_POST);
+               Hook::callAll('connector_settings_post', $_POST);
                return;
        }
 
@@ -314,17 +324,17 @@ function settings_post(App $a)
        if (($a->argc > 1) && ($a->argv[1] === 'display')) {
                BaseModule::checkFormSecurityTokenRedirectOnError('/settings/display', 'settings_display');
 
-               $theme             = x($_POST, 'theme')             ? notags(trim($_POST['theme']))        : $a->user['theme'];
-               $mobile_theme      = x($_POST, 'mobile_theme')      ? notags(trim($_POST['mobile_theme'])) : '';
-               $nosmile           = x($_POST, 'nosmile')           ? intval($_POST['nosmile'])            : 0;
-               $first_day_of_week = x($_POST, 'first_day_of_week') ? intval($_POST['first_day_of_week'])  : 0;
-               $noinfo            = x($_POST, 'noinfo')            ? intval($_POST['noinfo'])             : 0;
-               $infinite_scroll   = x($_POST, 'infinite_scroll')   ? intval($_POST['infinite_scroll'])    : 0;
-               $no_auto_update    = x($_POST, 'no_auto_update')    ? intval($_POST['no_auto_update'])     : 0;
-               $bandwidth_saver   = x($_POST, 'bandwidth_saver')   ? intval($_POST['bandwidth_saver'])    : 0;
-               $smart_threading   = x($_POST, 'smart_threading')   ? intval($_POST['smart_threading'])    : 0;
-               $nowarn_insecure   = x($_POST, 'nowarn_insecure')   ? intval($_POST['nowarn_insecure'])    : 0;
-               $browser_update    = x($_POST, 'browser_update')    ? intval($_POST['browser_update'])     : 0;
+               $theme             = !empty($_POST['theme'])             ? Strings::escapeTags(trim($_POST['theme']))        : $a->user['theme'];
+               $mobile_theme      = !empty($_POST['mobile_theme'])      ? Strings::escapeTags(trim($_POST['mobile_theme'])) : '';
+               $nosmile           = !empty($_POST['nosmile'])           ? intval($_POST['nosmile'])            : 0;
+               $first_day_of_week = !empty($_POST['first_day_of_week']) ? intval($_POST['first_day_of_week'])  : 0;
+               $noinfo            = !empty($_POST['noinfo'])            ? intval($_POST['noinfo'])             : 0;
+               $infinite_scroll   = !empty($_POST['infinite_scroll'])   ? intval($_POST['infinite_scroll'])    : 0;
+               $no_auto_update    = !empty($_POST['no_auto_update'])    ? intval($_POST['no_auto_update'])     : 0;
+               $bandwidth_saver   = !empty($_POST['bandwidth_saver'])   ? intval($_POST['bandwidth_saver'])    : 0;
+               $smart_threading   = !empty($_POST['smart_threading'])   ? intval($_POST['smart_threading'])    : 0;
+               $nowarn_insecure   = !empty($_POST['nowarn_insecure'])   ? intval($_POST['nowarn_insecure'])    : 0;
+               $browser_update    = !empty($_POST['browser_update'])    ? intval($_POST['browser_update'])     : 0;
                if ($browser_update != -1) {
                        $browser_update = $browser_update * 1000;
                        if ($browser_update < 10000) {
@@ -332,11 +342,11 @@ function settings_post(App $a)
                        }
                }
 
-               $itemspage_network = x($_POST, 'itemspage_network')  ? intval($_POST['itemspage_network'])  : 40;
+               $itemspage_network = !empty($_POST['itemspage_network'])  ? intval($_POST['itemspage_network'])  : 40;
                if ($itemspage_network > 100) {
                        $itemspage_network = 100;
                }
-               $itemspage_mobile_network = x($_POST, 'itemspage_mobile_network') ? intval($_POST['itemspage_mobile_network']) : 20;
+               $itemspage_mobile_network = !empty($_POST['itemspage_mobile_network']) ? intval($_POST['itemspage_mobile_network']) : 20;
                if ($itemspage_mobile_network > 100) {
                        $itemspage_mobile_network = 100;
                }
@@ -366,91 +376,79 @@ function settings_post(App $a)
                }
                Theme::install($theme);
 
-               $r = q("UPDATE `user` SET `theme` = '%s' WHERE `uid` = %d",
+               q("UPDATE `user` SET `theme` = '%s' WHERE `uid` = %d",
                                DBA::escape($theme),
                                intval(local_user())
                );
 
-               Addon::callHooks('display_settings_post', $_POST);
+               Hook::callAll('display_settings_post', $_POST);
                $a->internalRedirect('settings/display');
                return; // NOTREACHED
        }
 
        BaseModule::checkFormSecurityTokenRedirectOnError('/settings', 'settings');
 
-       if (x($_POST,'resend_relocate')) {
+       if (!empty($_POST['resend_relocate'])) {
                Worker::add(PRIORITY_HIGH, 'Notifier', 'relocate', local_user());
                info(L10n::t("Relocate message has been send to your contacts"));
                $a->internalRedirect('settings');
        }
 
-       Addon::callHooks('settings_post', $_POST);
+       Hook::callAll('settings_post', $_POST);
 
-       if (x($_POST, 'password') || x($_POST, 'confirm')) {
+       if (!empty($_POST['password']) || !empty($_POST['confirm'])) {
                $newpass = $_POST['password'];
                $confirm = $_POST['confirm'];
 
-               $err = false;
-               if ($newpass != $confirm) {
-                       notice(L10n::t('Passwords do not match. Password unchanged.') . EOL);
-                       $err = true;
-               }
-
-               if (!x($newpass) || !x($confirm)) {
-                       notice(L10n::t('Empty passwords are not allowed. Password unchanged.') . EOL);
-                       $err = true;
-               }
+               try {
+                       if ($newpass != $confirm) {
+                               throw new Exception(L10n::t('Passwords do not match.'));
+                       }
 
-               if (!Config::get('system', 'disable_password_exposed', false) && User::isPasswordExposed($newpass)) {
-                       notice(L10n::t('The new password has been exposed in a public data dump, please choose another.') . EOL);
-                       $err = true;
-               }
+                       //  check if the old password was supplied correctly before changing it to the new value
+                       User::getIdFromPasswordAuthentication(local_user(), $_POST['opassword']);
 
-               //  check if the old password was supplied correctly before changing it to the new value
-               if (!User::authenticate(intval(local_user()), $_POST['opassword'])) {
-                       notice(L10n::t('Wrong password.') . EOL);
-                       $err = true;
-               }
-
-               if (!$err) {
                        $result = User::updatePassword(local_user(), $newpass);
-                       if (DBA::isResult($result)) {
-                               info(L10n::t('Password changed.') . EOL);
-                       } else {
-                               notice(L10n::t('Password update failed. Please try again.') . EOL);
+                       if (!DBA::isResult($result)) {
+                               throw new Exception(L10n::t('Password update failed. Please try again.'));
                        }
+
+                       info(L10n::t('Password changed.'));
+               } catch (Exception $e) {
+                       notice($e->getMessage());
+                       notice(L10n::t('Password unchanged.'));
                }
        }
 
-       $username         = ((x($_POST, 'username'))   ? notags(trim($_POST['username']))     : '');
-       $email            = ((x($_POST, 'email'))      ? notags(trim($_POST['email']))        : '');
-       $timezone         = ((x($_POST, 'timezone'))   ? notags(trim($_POST['timezone']))     : '');
-       $language         = ((x($_POST, 'language'))   ? notags(trim($_POST['language']))     : '');
-
-       $defloc           = ((x($_POST, 'defloc'))     ? notags(trim($_POST['defloc']))       : '');
-       $openid           = ((x($_POST, 'openid_url')) ? notags(trim($_POST['openid_url']))   : '');
-       $maxreq           = ((x($_POST, 'maxreq'))     ? intval($_POST['maxreq'])             : 0);
-       $expire           = ((x($_POST, 'expire'))     ? intval($_POST['expire'])             : 0);
-       $def_gid          = ((x($_POST, 'group-selection')) ? intval($_POST['group-selection']) : 0);
-
-
-       $expire_items     = ((x($_POST, 'expire_items')) ? intval($_POST['expire_items'])        : 0);
-       $expire_notes     = ((x($_POST, 'expire_notes')) ? intval($_POST['expire_notes'])        : 0);
-       $expire_starred   = ((x($_POST, 'expire_starred')) ? intval($_POST['expire_starred']) : 0);
-       $expire_photos    = ((x($_POST, 'expire_photos'))? intval($_POST['expire_photos'])       : 0);
-       $expire_network_only    = ((x($_POST, 'expire_network_only'))? intval($_POST['expire_network_only'])     : 0);
-
-       $allow_location   = (((x($_POST, 'allow_location')) && (intval($_POST['allow_location']) == 1)) ? 1: 0);
-       $publish          = (((x($_POST, 'profile_in_directory')) && (intval($_POST['profile_in_directory']) == 1)) ? 1: 0);
-       $net_publish      = (((x($_POST, 'profile_in_netdirectory')) && (intval($_POST['profile_in_netdirectory']) == 1)) ? 1: 0);
-       $old_visibility   = (((x($_POST, 'visibility')) && (intval($_POST['visibility']) == 1)) ? 1 : 0);
-       $account_type     = (((x($_POST, 'account-type')) && (intval($_POST['account-type']))) ? intval($_POST['account-type']) : 0);
-       $page_flags       = (((x($_POST, 'page-flags')) && (intval($_POST['page-flags']))) ? intval($_POST['page-flags']) : 0);
-       $blockwall        = (((x($_POST, 'blockwall')) && (intval($_POST['blockwall']) == 1)) ? 0: 1); // this setting is inverted!
-       $blocktags        = (((x($_POST, 'blocktags')) && (intval($_POST['blocktags']) == 1)) ? 0: 1); // this setting is inverted!
-       $unkmail          = (((x($_POST, 'unkmail')) && (intval($_POST['unkmail']) == 1)) ? 1: 0);
-       $cntunkmail       = ((x($_POST, 'cntunkmail')) ? intval($_POST['cntunkmail']) : 0);
-       $suggestme        = ((x($_POST, 'suggestme')) ? intval($_POST['suggestme'])  : 0);
+       $username         = (!empty($_POST['username'])   ? Strings::escapeTags(trim($_POST['username']))     : '');
+       $email            = (!empty($_POST['email'])      ? Strings::escapeTags(trim($_POST['email']))        : '');
+       $timezone         = (!empty($_POST['timezone'])   ? Strings::escapeTags(trim($_POST['timezone']))     : '');
+       $language         = (!empty($_POST['language'])   ? Strings::escapeTags(trim($_POST['language']))     : '');
+
+       $defloc           = (!empty($_POST['defloc'])     ? Strings::escapeTags(trim($_POST['defloc']))       : '');
+       $openid           = (!empty($_POST['openid_url']) ? Strings::escapeTags(trim($_POST['openid_url']))   : '');
+       $maxreq           = (!empty($_POST['maxreq'])     ? intval($_POST['maxreq'])             : 0);
+       $expire           = (!empty($_POST['expire'])     ? intval($_POST['expire'])             : 0);
+       $def_gid          = (!empty($_POST['group-selection']) ? intval($_POST['group-selection']) : 0);
+
+
+       $expire_items     = (!empty($_POST['expire_items']) ? intval($_POST['expire_items'])     : 0);
+       $expire_notes     = (!empty($_POST['expire_notes']) ? intval($_POST['expire_notes'])     : 0);
+       $expire_starred   = (!empty($_POST['expire_starred']) ? intval($_POST['expire_starred']) : 0);
+       $expire_photos    = (!empty($_POST['expire_photos'])? intval($_POST['expire_photos'])    : 0);
+       $expire_network_only    = (!empty($_POST['expire_network_only'])? intval($_POST['expire_network_only'])  : 0);
+
+       $allow_location   = ((!empty($_POST['allow_location']) && (intval($_POST['allow_location']) == 1)) ? 1: 0);
+       $publish          = ((!empty($_POST['profile_in_directory']) && (intval($_POST['profile_in_directory']) == 1)) ? 1: 0);
+       $net_publish      = ((!empty($_POST['profile_in_netdirectory']) && (intval($_POST['profile_in_netdirectory']) == 1)) ? 1: 0);
+       $old_visibility   = ((!empty($_POST['visibility']) && (intval($_POST['visibility']) == 1)) ? 1 : 0);
+       $account_type     = ((!empty($_POST['account-type']) && (intval($_POST['account-type']))) ? intval($_POST['account-type']) : 0);
+       $page_flags       = ((!empty($_POST['page-flags']) && (intval($_POST['page-flags']))) ? intval($_POST['page-flags']) : 0);
+       $blockwall        = ((!empty($_POST['blockwall']) && (intval($_POST['blockwall']) == 1)) ? 0: 1); // this setting is inverted!
+       $blocktags        = ((!empty($_POST['blocktags']) && (intval($_POST['blocktags']) == 1)) ? 0: 1); // this setting is inverted!
+       $unkmail          = ((!empty($_POST['unkmail']) && (intval($_POST['unkmail']) == 1)) ? 1: 0);
+       $cntunkmail       = (!empty($_POST['cntunkmail']) ? intval($_POST['cntunkmail']) : 0);
+       $suggestme        = (!empty($_POST['suggestme']) ? intval($_POST['suggestme'])  : 0);
        $hide_friends     = (($_POST['hide-friends'] == 1) ? 1: 0);
        $hidewall         = (($_POST['hidewall'] == 1) ? 1: 0);
 
@@ -459,44 +457,42 @@ function settings_post(App $a)
 
        $notify = 0;
 
-       if (x($_POST, 'notify1')) {
+       if (!empty($_POST['notify1'])) {
                $notify += intval($_POST['notify1']);
        }
-       if (x($_POST, 'notify2')) {
+       if (!empty($_POST['notify2'])) {
                $notify += intval($_POST['notify2']);
        }
-       if (x($_POST, 'notify3')) {
+       if (!empty($_POST['notify3'])) {
                $notify += intval($_POST['notify3']);
        }
-       if (x($_POST, 'notify4')) {
+       if (!empty($_POST['notify4'])) {
                $notify += intval($_POST['notify4']);
        }
-       if (x($_POST, 'notify5')) {
+       if (!empty($_POST['notify5'])) {
                $notify += intval($_POST['notify5']);
        }
-       if (x($_POST, 'notify6')) {
+       if (!empty($_POST['notify6'])) {
                $notify += intval($_POST['notify6']);
        }
-       if (x($_POST, 'notify7')) {
+       if (!empty($_POST['notify7'])) {
                $notify += intval($_POST['notify7']);
        }
-       if (x($_POST, 'notify8')) {
+       if (!empty($_POST['notify8'])) {
                $notify += intval($_POST['notify8']);
        }
 
        // Adjust the page flag if the account type doesn't fit to the page flag.
-       if (($account_type == Contact::ACCOUNT_TYPE_PERSON) && !in_array($page_flags, [Contact::PAGE_NORMAL, Contact::PAGE_SOAPBOX, Contact::PAGE_FREELOVE])) {
-               $page_flags = Contact::PAGE_NORMAL;
-       } elseif (($account_type == Contact::ACCOUNT_TYPE_ORGANISATION) && !in_array($page_flags, [Contact::PAGE_SOAPBOX])) {
-               $page_flags = Contact::PAGE_SOAPBOX;
-       } elseif (($account_type == Contact::ACCOUNT_TYPE_NEWS) && !in_array($page_flags, [Contact::PAGE_SOAPBOX])) {
-               $page_flags = Contact::PAGE_SOAPBOX;
-       } elseif (($account_type == Contact::ACCOUNT_TYPE_COMMUNITY) && !in_array($page_flags, [Contact::PAGE_COMMUNITY, Contact::PAGE_PRVGROUP])) {
-               $page_flags = Contact::PAGE_COMMUNITY;
+       if (($account_type == User::ACCOUNT_TYPE_PERSON) && !in_array($page_flags, [User::PAGE_FLAGS_NORMAL, User::PAGE_FLAGS_SOAPBOX, User::PAGE_FLAGS_FREELOVE])) {
+               $page_flags = User::PAGE_FLAGS_NORMAL;
+       } elseif (($account_type == User::ACCOUNT_TYPE_ORGANISATION) && !in_array($page_flags, [User::PAGE_FLAGS_SOAPBOX])) {
+               $page_flags = User::PAGE_FLAGS_SOAPBOX;
+       } elseif (($account_type == User::ACCOUNT_TYPE_NEWS) && !in_array($page_flags, [User::PAGE_FLAGS_SOAPBOX])) {
+               $page_flags = User::PAGE_FLAGS_SOAPBOX;
+       } elseif (($account_type == User::ACCOUNT_TYPE_COMMUNITY) && !in_array($page_flags, [User::PAGE_FLAGS_COMMUNITY, User::PAGE_FLAGS_PRVGROUP])) {
+               $page_flags = User::PAGE_FLAGS_COMMUNITY;
        }
 
-       $email_changed = false;
-
        $err = '';
 
        if ($username != $a->user['username']) {
@@ -509,14 +505,13 @@ function settings_post(App $a)
        }
 
        if ($email != $a->user['email']) {
-               $email_changed = true;
                //  check for the correct password
                if (!User::authenticate(intval(local_user()), $_POST['mpassword'])) {
                        $err .= L10n::t('Wrong Password') . EOL;
                        $email = $a->user['email'];
                }
                //  check the email is valid
-               if (!valid_email($email)) {
+               if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
                        $err .= L10n::t('Invalid email.');
                }
                //  ensure new email is not the admin mail
@@ -544,7 +539,7 @@ function settings_post(App $a)
        $str_contact_deny  = !empty($_POST['contact_deny'])  ? perms2str($_POST['contact_deny'])  : '';
 
        $openidserver = $a->user['openidserver'];
-       //$openid = normalise_openid($openid);
+       //$openid = Strings::normaliseOpenID($openid);
 
        // If openid has changed or if there's an openid but no openidserver, try and discover it.
        if ($openid != $a->user['openid'] || (strlen($openid) && (!strlen($openidserver)))) {
@@ -569,7 +564,7 @@ function settings_post(App $a)
        PConfig::set(local_user(), 'system', 'email_textonly', $email_textonly);
        PConfig::set(local_user(), 'system', 'detailed_notif', $detailed_notif);
 
-       if ($page_flags == Contact::PAGE_PRVGROUP) {
+       if ($page_flags == User::PAGE_FLAGS_PRVGROUP) {
                $hidewall = 1;
                if (!$str_contact_allow && !$str_group_allow && !$str_contact_deny && !$str_group_deny) {
                        if ($def_gid) {
@@ -622,7 +617,7 @@ function settings_post(App $a)
        // clear session language
        unset($_SESSION['language']);
 
-       $r = q("UPDATE `profile`
+       q("UPDATE `profile`
                SET `publish` = %d,
                `name` = '%s',
                `net-publish` = %d,
@@ -665,7 +660,7 @@ function settings_content(App $a)
                return Login::form();
        }
 
-       if (x($_SESSION, 'submanage') && intval($_SESSION['submanage'])) {
+       if (!empty($_SESSION['submanage'])) {
                notice(L10n::t('Permission denied.') . EOL);
                return;
        }
@@ -754,7 +749,7 @@ function settings_content(App $a)
                        $settings_addons = L10n::t('No Addon settings configured');
                }
 
-               Addon::callHooks('addon_settings', $settings_addons);
+               Hook::callAll('addon_settings', $settings_addons);
 
 
                $tpl = Renderer::getMarkupTemplate('settings/addons.tpl');
@@ -795,13 +790,13 @@ function settings_content(App $a)
                $default_group             = PConfig::get(local_user(), 'ostatus', 'default_group');
                $legacy_contact            = PConfig::get(local_user(), 'ostatus', 'legacy_contact');
 
-               if (x($legacy_contact)) {
+               if (!empty($legacy_contact)) {
                        /// @todo Isn't it supposed to be a $a->internalRedirect() call?
                        $a->page['htmlhead'] = '<meta http-equiv="refresh" content="0; URL=' . System::baseUrl().'/ostatus_subscribe?url=' . urlencode($legacy_contact) . '">';
                }
 
                $settings_connectors = '';
-               Addon::callHooks('connector_settings', $settings_connectors);
+               Hook::callAll('connector_settings', $settings_connectors);
 
                if (is_site_admin()) {
                        $diasp_enabled = L10n::t('Built-in support for %s connectivity is %s', L10n::t('Diaspora'), ((Config::get('system', 'diaspora_enabled')) ? L10n::t('enabled') : L10n::t('disabled')));
@@ -874,7 +869,7 @@ function settings_content(App $a)
                        '$submit' => L10n::t('Save Settings'),
                ]);
 
-               Addon::callHooks('display_settings', $o);
+               Hook::callAll('display_settings', $o);
                return $o;
        }
 
@@ -891,40 +886,30 @@ function settings_content(App $a)
                        $default_mobile_theme = 'none';
                }
 
-               $allowed_themes_str = Config::get('system', 'allowed_themes');
-               $allowed_themes_raw = explode(',', $allowed_themes_str);
-               $allowed_themes = [];
-               if (count($allowed_themes_raw)) {
-                       foreach ($allowed_themes_raw as $x) {
-                               if (strlen(trim($x)) && is_dir("view/theme/$x")) {
-                                       $allowed_themes[] = trim($x);
-                               }
-                       }
-               }
-
+               $allowed_themes = Theme::getAllowedList();
 
                $themes = [];
                $mobile_themes = ["---" => L10n::t('No special theme for mobile devices')];
-               if ($allowed_themes) {
-                       foreach ($allowed_themes as $theme) {
-                               $is_experimental = file_exists('view/theme/' . $theme . '/experimental');
-                               $is_unsupported  = file_exists('view/theme/' . $theme . '/unsupported');
-                               $is_mobile       = file_exists('view/theme/' . $theme . '/mobile');
-                               if (!$is_experimental || ($is_experimental && (Config::get('experimentals', 'exp_themes')==1 || is_null(Config::get('experimentals', 'exp_themes'))))) {
-                                       $theme_name = ucfirst($theme);
-                                       if ($is_unsupported) {
-                                               $theme_name = L10n::t("%s - \x28Unsupported\x29", $theme_name);
-                                       } elseif ($is_experimental) {
-                                               $theme_name = L10n::t("%s - \x28Experimental\x29", $theme_name);
-                                       }
-                                       if ($is_mobile) {
-                                               $mobile_themes[$theme] = $theme_name;
-                                       } else {
-                                               $themes[$theme] = $theme_name;
-                                       }
+               foreach ($allowed_themes as $theme) {
+                       $is_experimental = file_exists('view/theme/' . $theme . '/experimental');
+                       $is_unsupported  = file_exists('view/theme/' . $theme . '/unsupported');
+                       $is_mobile       = file_exists('view/theme/' . $theme . '/mobile');
+                       if (!$is_experimental || ($is_experimental && (Config::get('experimentals', 'exp_themes')==1 || is_null(Config::get('experimentals', 'exp_themes'))))) {
+                               $theme_name = ucfirst($theme);
+                               if ($is_unsupported) {
+                                       $theme_name = L10n::t('%s - (Unsupported)', $theme_name);
+                               } elseif ($is_experimental) {
+                                       $theme_name = L10n::t('%s - (Experimental)', $theme_name);
+                               }
+
+                               if ($is_mobile) {
+                                       $mobile_themes[$theme] = $theme_name;
+                               } else {
+                                       $themes[$theme] = $theme_name;
                                }
                        }
                }
+
                $theme_selected        = defaults($_SESSION, 'theme'       , $default_theme);
                $mobile_theme_selected = defaults($_SESSION, 'mobile-theme', $default_mobile_theme);
 
@@ -1028,9 +1013,9 @@ function settings_content(App $a)
 
        // Set the account type to "Community" when the page is a community page but the account type doesn't fit
        // This is only happening on the first visit after the update
-       if (in_array($a->user['page-flags'], [Contact::PAGE_COMMUNITY, Contact::PAGE_PRVGROUP]) &&
-               ($a->user['account-type'] != Contact::ACCOUNT_TYPE_COMMUNITY))
-               $a->user['account-type'] = Contact::ACCOUNT_TYPE_COMMUNITY;
+       if (in_array($a->user['page-flags'], [User::PAGE_FLAGS_COMMUNITY, User::PAGE_FLAGS_PRVGROUP]) &&
+               ($a->user['account-type'] != User::ACCOUNT_TYPE_COMMUNITY))
+               $a->user['account-type'] = User::ACCOUNT_TYPE_COMMUNITY;
 
        $pageset_tpl = Renderer::getMarkupTemplate('settings/pagetypes.tpl');
 
@@ -1039,46 +1024,46 @@ function settings_content(App $a)
                '$user'                 => L10n::t("Personal Page Subtypes"),
                '$community'            => L10n::t("Community Forum Subtypes"),
                '$account_type'         => $a->user['account-type'],
-               '$type_person'          => Contact::ACCOUNT_TYPE_PERSON,
-               '$type_organisation'    => Contact::ACCOUNT_TYPE_ORGANISATION,
-               '$type_news'            => Contact::ACCOUNT_TYPE_NEWS,
-               '$type_community'       => Contact::ACCOUNT_TYPE_COMMUNITY,
+               '$type_person'          => User::ACCOUNT_TYPE_PERSON,
+               '$type_organisation'    => User::ACCOUNT_TYPE_ORGANISATION,
+               '$type_news'            => User::ACCOUNT_TYPE_NEWS,
+               '$type_community'       => User::ACCOUNT_TYPE_COMMUNITY,
 
-               '$account_person'       => ['account-type', L10n::t('Personal Page'), Contact::ACCOUNT_TYPE_PERSON,
+               '$account_person'       => ['account-type', L10n::t('Personal Page'), User::ACCOUNT_TYPE_PERSON,
                                                                        L10n::t('Account for a personal profile.'),
-                                                                       ($a->user['account-type'] == Contact::ACCOUNT_TYPE_PERSON)],
+                                                                       ($a->user['account-type'] == User::ACCOUNT_TYPE_PERSON)],
 
-               '$account_organisation' => ['account-type', L10n::t('Organisation Page'), Contact::ACCOUNT_TYPE_ORGANISATION,
+               '$account_organisation' => ['account-type', L10n::t('Organisation Page'), User::ACCOUNT_TYPE_ORGANISATION,
                                                                        L10n::t('Account for an organisation that automatically approves contact requests as "Followers".'),
-                                                                       ($a->user['account-type'] == Contact::ACCOUNT_TYPE_ORGANISATION)],
+                                                                       ($a->user['account-type'] == User::ACCOUNT_TYPE_ORGANISATION)],
 
-               '$account_news'         => ['account-type', L10n::t('News Page'), Contact::ACCOUNT_TYPE_NEWS,
+               '$account_news'         => ['account-type', L10n::t('News Page'), User::ACCOUNT_TYPE_NEWS,
                                                                        L10n::t('Account for a news reflector that automatically approves contact requests as "Followers".'),
-                                                                       ($a->user['account-type'] == Contact::ACCOUNT_TYPE_NEWS)],
+                                                                       ($a->user['account-type'] == User::ACCOUNT_TYPE_NEWS)],
 
-               '$account_community'    => ['account-type', L10n::t('Community Forum'), Contact::ACCOUNT_TYPE_COMMUNITY,
+               '$account_community'    => ['account-type', L10n::t('Community Forum'), User::ACCOUNT_TYPE_COMMUNITY,
                                                                        L10n::t('Account for community discussions.'),
-                                                                       ($a->user['account-type'] == Contact::ACCOUNT_TYPE_COMMUNITY)],
+                                                                       ($a->user['account-type'] == User::ACCOUNT_TYPE_COMMUNITY)],
 
-               '$page_normal'          => ['page-flags', L10n::t('Normal Account Page'), Contact::PAGE_NORMAL,
+               '$page_normal'          => ['page-flags', L10n::t('Normal Account Page'), User::PAGE_FLAGS_NORMAL,
                                                                        L10n::t('Account for a regular personal profile that requires manual approval of "Friends" and "Followers".'),
-                                                                       ($a->user['page-flags'] == Contact::PAGE_NORMAL)],
+                                                                       ($a->user['page-flags'] == User::PAGE_FLAGS_NORMAL)],
 
-               '$page_soapbox'         => ['page-flags', L10n::t('Soapbox Page'), Contact::PAGE_SOAPBOX,
+               '$page_soapbox'         => ['page-flags', L10n::t('Soapbox Page'), User::PAGE_FLAGS_SOAPBOX,
                                                                        L10n::t('Account for a public profile that automatically approves contact requests as "Followers".'),
-                                                                       ($a->user['page-flags'] == Contact::PAGE_SOAPBOX)],
+                                                                       ($a->user['page-flags'] == User::PAGE_FLAGS_SOAPBOX)],
 
-               '$page_community'       => ['page-flags', L10n::t('Public Forum'), Contact::PAGE_COMMUNITY,
+               '$page_community'       => ['page-flags', L10n::t('Public Forum'), User::PAGE_FLAGS_COMMUNITY,
                                                                        L10n::t('Automatically approves all contact requests.'),
-                                                                       ($a->user['page-flags'] == Contact::PAGE_COMMUNITY)],
+                                                                       ($a->user['page-flags'] == User::PAGE_FLAGS_COMMUNITY)],
 
-               '$page_freelove'        => ['page-flags', L10n::t('Automatic Friend Page'), Contact::PAGE_FREELOVE,
+               '$page_freelove'        => ['page-flags', L10n::t('Automatic Friend Page'), User::PAGE_FLAGS_FREELOVE,
                                                                        L10n::t('Account for a popular profile that automatically approves contact requests as "Friends".'),
-                                                                       ($a->user['page-flags'] == Contact::PAGE_FREELOVE)],
+                                                                       ($a->user['page-flags'] == User::PAGE_FLAGS_FREELOVE)],
 
-               '$page_prvgroup'        => ['page-flags', L10n::t('Private Forum [Experimental]'), Contact::PAGE_PRVGROUP,
+               '$page_prvgroup'        => ['page-flags', L10n::t('Private Forum [Experimental]'), User::PAGE_FLAGS_PRVGROUP,
                                                                        L10n::t('Requires manual approval of contact requests.'),
-                                                                       ($a->user['page-flags'] == Contact::PAGE_PRVGROUP)],
+                                                                       ($a->user['page-flags'] == User::PAGE_FLAGS_PRVGROUP)],
 
 
        ]);
@@ -1192,7 +1177,7 @@ function settings_content(App $a)
                '$nickname_block' => $prof_addr,
 
                '$h_pass'       => L10n::t('Password Settings'),
-               '$password1'=> ['password', L10n::t('New Password:'), '', ''],
+               '$password1'=> ['password', L10n::t('New Password:'), '', L10n::t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces, accentuated letters and colon (:).')],
                '$password2'=> ['confirm', L10n::t('Confirm:'), '', L10n::t('Leave password fields blank unless changing')],
                '$password3'=> ['opassword', L10n::t('Current Password:'), '', L10n::t('Your current password to confirm the changes')],
                '$password4'=> ['mpassword', L10n::t('Password:'), '', L10n::t('Your current password to confirm the changes')],
@@ -1273,7 +1258,7 @@ function settings_content(App $a)
 
        ]);
 
-       Addon::callHooks('settings_form', $o);
+       Hook::callAll('settings_form', $o);
 
        $o .= '</form>' . "\r\n";