Use getByNickname as suggested in code review.

[friendica.git] / src / Model / User.php

diff --git a/src/Model/User.php b/src/Model/User.php
index d3f3dfd1a9cd4b1c33b9ac293bd17dec6c31e4ce..3b11ee6ce8b273607878988533edaa32af951d64 100644 (file)
--- a/src/Model/User.php
+++ b/src/Model/User.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @copyright Copyright (C) 2020, Friendica
+ * @copyright Copyright (C) 2010-2021, the Friendica project
  *
  * @license GNU AGPL version 3 or any later version
  *
@@ -34,7 +34,7 @@ use Friendica\Core\System;
 use Friendica\Core\Worker;
 use Friendica\Database\DBA;
 use Friendica\DI;
-use Friendica\Model\TwoFactor\AppSpecificPassword;
+use Friendica\Security\TwoFactor\Model\AppSpecificPassword;
 use Friendica\Network\HTTPException;
 use Friendica\Object\Image;
 use Friendica\Util\Crypto;
@@ -97,6 +97,7 @@ class User
        const ACCOUNT_TYPE_NEWS =         2;
        const ACCOUNT_TYPE_COMMUNITY =    3;
        const ACCOUNT_TYPE_RELAY =        4;
+       const ACCOUNT_TYPE_DELETED =    127;
        /**
         * @}
         */
@@ -398,7 +399,7 @@ class User
                        return false;
                }
 
-               if (!$repairMissing) {
+               if (!$repairMissing || $owner['account_expired']) {
                        return $owner;
                }
 
@@ -543,6 +544,24 @@ class User
                        }
 
                        return $user['uid'];
+               } else {
+                       $addon_auth = [
+                               'username'      => $user['nickname'],
+                               'password'      => $password,
+                               'authenticated' => 0,
+                               'user_record'   => null
+                       ];
+
+                       /*
+                        * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
+                        * Addons should never set 'authenticated' except to indicate success - as hooks may be chained
+                        * and later addons should not interfere with an earlier one that succeeded.
+                        */
+                       Hook::callAll('authenticate', $addon_auth);
+
+                       if ($addon_auth['authenticated'] && $addon_auth['user_record']) {
+                               return $user['uid'];
+                       }
                }
 
                throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed'));
@@ -583,7 +602,7 @@ class User
                        if (is_int($user_info)) {
                                $user = DBA::selectFirst(
                                        'user',
-                                       ['uid', 'password', 'legacy_password'],
+                                       ['uid', 'nickname', 'password', 'legacy_password'],
                                        [
                                                'uid' => $user_info,
                                                'blocked' => 0,
@@ -593,7 +612,7 @@ class User
                                        ]
                                );
                        } else {
-                               $fields = ['uid', 'password', 'legacy_password'];
+                               $fields = ['uid', 'nickname', 'password', 'legacy_password'];
                                $condition = [
                                        "(`email` = ? OR `username` = ? OR `nickname` = ?)
                                        AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified`",
@@ -1158,6 +1177,9 @@ class User
                        return false;
                }
 
+               // Delete the avatar
+               Photo::delete(['uid' => $register['uid']]);
+
                return DBA::delete('user', ['uid' => $register['uid']]) &&
                       Register::deleteByHash($register['hash']);
        }
@@ -1349,7 +1371,7 @@ class User
         */
        public static function remove(int $uid)
        {
-               if (!$uid) {
+               if (empty($uid)) {
                        return false;
                }
 
@@ -1363,6 +1385,9 @@ class User
                // unique), so it cannot be re-registered in the future.
                DBA::insert('userd', ['username' => $user['nickname']]);
 
+               // Remove all personal settings, especially connector settings
+               DBA::delete('pconfig', ['uid' => $uid]);
+
                // The user and related data will be deleted in Friendica\Worker\ExpireAndRemoveUsers
                DBA::update('user', ['account_removed' => true, 'account_expires_on' => DateTimeFormat::utc('now + 7 day')], ['uid' => $uid]);
                Worker::add(PRIORITY_HIGH, 'Notifier', Delivery::REMOVAL, $uid);