clones/friendica
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #4003 from MrPetovan/task/3942-move-user-to-src 

Migrate password hashing Part 2: Move include/user to src
This commit is contained in:
Michael Vogel 2017-12-04 10:32:45 +01:00 committed by GitHub
parent 370cf6bd91 85f6d6b7ed
commit 2685c9bb1c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 545 additions and 516 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

453
include/user.php
View File

@ -1,453 +0,0 @@
<?php
/**
* @file include/user.php
*/
use Friendica\Core\Config;
use Friendica\Core\System;
use Friendica\Database\DBM;
use Friendica\Object\Photo;
require_once 'include/network.php';
require_once 'include/plugin.php';
require_once 'include/text.php';
require_once 'include/pgettext.php';
require_once 'include/datetime.php';
require_once 'include/enotify.php';
function create_user($arr) {
// Required: { username, nickname, email } or { openid_url }
$a = get_app();
$result = array('success' => false, 'user' => null, 'password' => '', 'message' => '');
$using_invites = Config::get('system','invitation_only');
$num_invites = Config::get('system','number_invites');
$invite_id = ((x($arr,'invite_id')) ? notags(trim($arr['invite_id'])) : '');
$username = ((x($arr,'username')) ? notags(trim($arr['username'])) : '');
$nickname = ((x($arr,'nickname')) ? notags(trim($arr['nickname'])) : '');
$email = ((x($arr,'email')) ? notags(trim($arr['email'])) : '');
$openid_url = ((x($arr,'openid_url')) ? notags(trim($arr['openid_url'])) : '');
$photo = ((x($arr,'photo')) ? notags(trim($arr['photo'])) : '');
$password = ((x($arr,'password')) ? trim($arr['password']) : '');
$password1 = ((x($arr,'password1')) ? trim($arr['password1']) : '');
$confirm = ((x($arr,'confirm')) ? trim($arr['confirm']) : '');
$blocked = ((x($arr,'blocked')) ? intval($arr['blocked']) : 0);
$verified = ((x($arr,'verified')) ? intval($arr['verified']) : 0);
$publish = ((x($arr,'profile_publish_reg') && intval($arr['profile_publish_reg'])) ? 1 : 0);
$netpublish = ((strlen(Config::get('system','directory'))) ? $publish : 0);
if ($password1 != $confirm) {
$result['message'] .= t('Passwords do not match. Password unchanged.') . EOL;
return $result;
} elseif ($password1 != "")
$password = $password1;
$tmp_str = $openid_url;
if($using_invites) {
if(! $invite_id) {
$result['message'] .= t('An invitation is required.') . EOL;
return $result;
}
$r = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1", dbesc($invite_id));
if(! results($r)) {
$result['message'] .= t('Invitation could not be verified.') . EOL;
return $result;
}
}
if((! x($username)) || (! x($email)) || (! x($nickname))) {
if($openid_url) {
if(! validate_url($tmp_str)) {
$result['message'] .= t('Invalid OpenID url') . EOL;
return $result;
}
$_SESSION['register'] = 1;
$_SESSION['openid'] = $openid_url;
require_once('library/openid.php');
$openid = new LightOpenID;
$openid->identity = $openid_url;
$openid->returnUrl = System::baseUrl() . '/openid';
$openid->required = array('namePerson/friendly', 'contact/email', 'namePerson');
$openid->optional = array('namePerson/first','media/image/aspect11','media/image/default');
try {
$authurl = $openid->authUrl();
} catch (Exception $e){
$result['message'] .= t("We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID."). EOL . EOL . t("The error message was:") . $e->getMessage() . EOL;
return $result;
}
goaway($authurl);
// NOTREACHED
}
notice( t('Please enter the required information.') . EOL );
return;
}
if(! validate_url($tmp_str))
$openid_url = '';
$err = '';
// collapse multiple spaces in name
$username = preg_replace('/ +/',' ',$username);
if(mb_strlen($username) > 48)
$result['message'] .= t('Please use a shorter name.') . EOL;
if(mb_strlen($username) < 3)
$result['message'] .= t('Name too short.') . EOL;
// So now we are just looking for a space in the full name.
$loose_reg = Config::get('system','no_regfullname');
if(! $loose_reg) {
$username = mb_convert_case($username,MB_CASE_TITLE,'UTF-8');
if(! strpos($username,' '))
$result['message'] .= t("That doesn't appear to be your full \x28First Last\x29 name.") . EOL;
}
if(! allowed_email($email))
$result['message'] .= t('Your email domain is not among those allowed on this site.') . EOL;
if((! valid_email($email)) || (! validate_email($email)))
$result['message'] .= t('Not a valid email address.') . EOL;
// Disallow somebody creating an account using openid that uses the admin email address,
// since openid bypasses email verification. We'll allow it if there is not yet an admin account.
$adminlist = explode(",", str_replace(" ", "", strtolower($a->config['admin_email'])));
//if((x($a->config,'admin_email')) && (strcasecmp($email,$a->config['admin_email']) == 0) && strlen($openid_url)) {
if((x($a->config,'admin_email')) && in_array(strtolower($email), $adminlist) && strlen($openid_url)) {
$r = q("SELECT * FROM `user` WHERE `email` = '%s' LIMIT 1",
dbesc($email)
);
if (DBM::is_result($r))
$result['message'] .= t('Cannot use that email.') . EOL;
}
$nickname = $arr['nickname'] = strtolower($nickname);
if(! preg_match("/^[a-z0-9][a-z0-9\_]*$/",$nickname))
$result['message'] .= t('Your "nickname" can only contain "a-z", "0-9" and "_".') . EOL;
$r = q("SELECT `uid` FROM `user`
WHERE `nickname` = '%s' LIMIT 1",
dbesc($nickname)
);
if (DBM::is_result($r))
$result['message'] .= t('Nickname is already registered. Please choose another.') . EOL;
// Check deleted accounts that had this nickname. Doesn't matter to us,
// but could be a security issue for federated platforms.
$r = q("SELECT * FROM `userd`
WHERE `username` = '%s' LIMIT 1",
dbesc($nickname)
);
if (DBM::is_result($r))
$result['message'] .= t('Nickname was once registered here and may not be re-used. Please choose another.') . EOL;
if(strlen($result['message'])) {
return $result;
}
$new_password = ((strlen($password)) ? $password : autoname(6) . mt_rand(100,9999));
$new_password_encoded = hash('whirlpool',$new_password);
$result['password'] = $new_password;
require_once('include/crypto.php');
$keys = new_keypair(4096);
if($keys === false) {
$result['message'] .= t('SERIOUS ERROR: Generation of security keys failed.') . EOL;
return $result;
}
$prvkey = $keys['prvkey'];
$pubkey = $keys['pubkey'];
// Create another keypair for signing/verifying salmon protocol messages.
$sres = new_keypair(512);
$sprvkey = $sres['prvkey'];
$spubkey = $sres['pubkey'];
$r = q("INSERT INTO `user` (`guid`, `username`, `password`, `email`, `openid`, `nickname`,
`pubkey`, `prvkey`, `spubkey`, `sprvkey`, `register_date`, `verified`, `blocked`, `timezone`, `default-location`)
VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, 'UTC', '')",
dbesc(generate_user_guid()),
dbesc($username),
dbesc($new_password_encoded),
dbesc($email),
dbesc($openid_url),
dbesc($nickname),
dbesc($pubkey),
dbesc($prvkey),
dbesc($spubkey),
dbesc($sprvkey),
dbesc(datetime_convert()),
intval($verified),
intval($blocked)
);
if ($r) {
$r = q("SELECT * FROM `user`
WHERE `username` = '%s' AND `password` = '%s' LIMIT 1",
dbesc($username),
dbesc($new_password_encoded)
);
if (DBM::is_result($r)) {
$u = $r[0];
$newuid = intval($r[0]['uid']);
}
}
else {
$result['message'] .= t('An error occurred during registration. Please try again.') . EOL ;
return $result;
}
/**
* if somebody clicked submit twice very quickly, they could end up with two accounts
* due to race condition. Remove this one.
*/
$r = q("SELECT `uid` FROM `user`
WHERE `nickname` = '%s' ",
dbesc($nickname)
);
if ((DBM::is_result($r)) && (count($r) > 1) && $newuid) {
$result['message'] .= t('Nickname is already registered. Please choose another.') . EOL;
dba::delete('user', array('uid' => $newuid));
return $result;
}
if(x($newuid) !== false) {
$r = q("INSERT INTO `profile` ( `uid`, `profile-name`, `is-default`, `name`, `photo`, `thumb`, `publish`, `net-publish` )
VALUES ( %d, '%s', %d, '%s', '%s', '%s', %d, %d ) ",
intval($newuid),
t('default'),
1,
dbesc($username),
dbesc(System::baseUrl() . "/photo/profile/{$newuid}.jpg"),
dbesc(System::baseUrl() . "/photo/avatar/{$newuid}.jpg"),
intval($publish),
intval($netpublish)
);
if ($r === false) {
$result['message'] .= t('An error occurred creating your default profile. Please try again.') . EOL;
// Start fresh next time.
dba::delete('user', array('uid' => $newuid));
return $result;
}
// Create the self contact
user_create_self_contact($newuid);
// Create a group with no members. This allows somebody to use it
// right away as a default group for new contacts.
require_once('include/group.php');
group_add($newuid, t('Friends'));
$r = q("SELECT `id` FROM `group` WHERE `uid` = %d AND `name` = '%s'",
intval($newuid),
dbesc(t('Friends'))
);
if (DBM::is_result($r)) {
$def_gid = $r[0]['id'];
q("UPDATE `user` SET `def_gid` = %d WHERE `uid` = %d",
intval($r[0]['id']),
intval($newuid)
);
}
if(Config::get('system', 'newuser_private') && $def_gid) {
q("UPDATE `user` SET `allow_gid` = '%s' WHERE `uid` = %d",
dbesc("<" . $def_gid . ">"),
intval($newuid)
);
}
}
// if we have no OpenID photo try to look up an avatar
if(! strlen($photo))
$photo = avatar_img($email);
// unless there is no avatar-plugin loaded
if (strlen($photo)) {
$photo_failure = false;
$filename = basename($photo);
$img_str = fetch_url($photo, true);
// guess mimetype from headers or filename
$type = Photo::guessImageType($photo, true);
$img = new Photo($img_str, $type);
if ($img->isValid()) {
$img->scaleImageSquare(175);
$hash = photo_new_resource();
$r = $img->store($newuid, 0, $hash, $filename, t('Profile Photos'), 4);
if ($r === false) {
$photo_failure = true;
}
$img->scaleImage(80);
$r = $img->store($newuid, 0, $hash, $filename, t('Profile Photos'), 5 );
if ($r === false) {
$photo_failure = true;
}
$img->scaleImage(48);
$r = $img->store($newuid, 0, $hash, $filename, t('Profile Photos'), 6 );
if ($r === false) {
$photo_failure = true;
}
if (! $photo_failure) {
q("UPDATE `photo` SET `profile` = 1 WHERE `resource-id` = '%s' ",
dbesc($hash)
);
}
}
}
call_hooks('register_account', $newuid);
$result['success'] = true;
$result['user'] = $u;
return $result;
}
/**
* @brief create the "self" contact from data from the user table
*
* @param integer $uid
*/
function user_create_self_contact($uid) {
// Only create the entry if it doesn't exist yet
$r = q("SELECT `id` FROM `contact` WHERE `uid` = %d AND `self`", intval($uid));
if (DBM::is_result($r)) {
return;
}
$r = q("SELECT `uid`, `username`, `nickname` FROM `user` WHERE `uid` = %d", intval($uid));
if (!DBM::is_result($r)) {
return;
}
$user = $r[0];
q("INSERT INTO `contact` (`uid`, `created`, `self`, `name`, `nick`, `photo`, `thumb`, `micro`, `blocked`, `pending`, `url`, `nurl`,
`addr`, `request`, `notify`, `poll`, `confirm`, `poco`, `name-date`, `uri-date`, `avatar-date`, `closeness`)
VALUES (%d, '%s', 1, '%s', '%s', '%s', '%s', '%s', 0, 0, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', 0)",
intval($user['uid']),
datetime_convert(),
dbesc($user['username']),
dbesc($user['nickname']),
dbesc(System::baseUrl()."/photo/profile/".$user['uid'].".jpg"),
dbesc(System::baseUrl()."/photo/avatar/".$user['uid'].".jpg"),
dbesc(System::baseUrl()."/photo/micro/".$user['uid'].".jpg"),
dbesc(System::baseUrl()."/profile/".$user['nickname']),
dbesc(normalise_link(System::baseUrl()."/profile/".$user['nickname'])),
dbesc($user['nickname'].'@'.substr(System::baseUrl(), strpos(System::baseUrl(),'://') + 3)),
dbesc(System::baseUrl()."/dfrn_request/".$user['nickname']),
dbesc(System::baseUrl()."/dfrn_notify/".$user['nickname']),
dbesc(System::baseUrl()."/dfrn_poll/".$user['nickname']),
dbesc(System::baseUrl()."/dfrn_confirm/".$user['nickname']),
dbesc(System::baseUrl()."/poco/".$user['nickname']),
dbesc(datetime_convert()),
dbesc(datetime_convert()),
dbesc(datetime_convert())
);
}
/**
* @brief send registration confiŕmation with the intormation that reg is pending
*
* @param string $email
* @param string $sitename
* @param string $username
* @return NULL|boolean from notification() and email() inherited
*/
function send_register_pending_eml($email, $sitename, $username) {
$body = deindent(t('
Dear %1$s,
Thank you for registering at %2$s. Your account is pending for approval by the administrator.
'));
$body = sprintf($body, $username, $sitename);
return notification(array(
'type' => SYSTEM_EMAIL,
'to_email' => $email,
'subject'=> sprintf( t('Registration at %s'), $sitename),
'body' => $body));
}
/*
* send registration confirmation.
* It's here as a function because the mail is sent
* from different parts
*/
function send_register_open_eml($email, $sitename, $siteurl, $username, $password){
$preamble = deindent(t('
Dear %1$s,
Thank you for registering at %2$s. Your account has been created.
'));
$body = deindent(t('
The login details are as follows:
Site Location: %3$s
Login Name: %1$s
Password: %5$s
You may change your password from your account "Settings" page after logging
in.
Please take a few moments to review the other account settings on that page.
You may also wish to add some basic information to your default profile
(on the "Profiles" page) so that other people can easily find you.
We recommend setting your full name, adding a profile photo,
adding some profile "keywords" (very useful in making new friends) - and
perhaps what country you live in; if you do not wish to be more specific
than that.
We fully respect your right to privacy, and none of these items are necessary.
If you are new and do not know anybody here, they may help
you to make some new and interesting friends.
Thank you and welcome to %2$s.'));
$preamble = sprintf($preamble, $username, $sitename);
$body = sprintf($body, $email, $sitename, $siteurl, $username, $password);
return notification(array(
'type' => SYSTEM_EMAIL,
'to_email' => $email,
'subject'=> sprintf( t('Registration details for %s'), $sitename),
'preamble'=> $preamble,
'body' => $body));
}

4
mod/admin.php
View File

@ -1466,9 +1466,7 @@ function admin_page_users_post(App $a)
check_form_security_token_redirectOnErr('/admin/users', 'admin_users'); check_form_security_token_redirectOnErr('/admin/users', 'admin_users');
if (!($nu_name === "") && !($nu_email === "") && !($nu_nickname === "")) { if (!($nu_name === "") && !($nu_email === "") && !($nu_nickname === "")) {
require_once 'include/user.php'; $result = User::create(array('username' => $nu_name, 'email' => $nu_email,
$result = create_user(array('username' => $nu_name, 'email' => $nu_email,
'nickname' => $nu_nickname, 'verified' => 1, 'language' => $nu_language)); 'nickname' => $nu_nickname, 'verified' => 1, 'language' => $nu_language));
if (!$result['success']) { if (!$result['success']) {
notice($result['message']); notice($result['message']);

12
mod/register.php
View File

@ -5,10 +5,10 @@ use Friendica\Core\Config;
use Friendica\Core\PConfig; use Friendica\Core\PConfig;
use Friendica\Core\System; use Friendica\Core\System;
use Friendica\Core\Worker; use Friendica\Core\Worker;
use Friendica\Model\User;
require_once('include/enotify.php'); require_once 'include/enotify.php';
require_once('include/bbcode.php'); require_once 'include/bbcode.php';
require_once('include/user.php');
if(! function_exists('register_post')) { if(! function_exists('register_post')) {
function register_post(App $a) { function register_post(App $a) {
@ -61,7 +61,7 @@ function register_post(App $a) {
$arr['verified'] = $verified; $arr['verified'] = $verified;
$arr['language'] = get_browser_language(); $arr['language'] = get_browser_language();
$result = create_user($arr); $result = User::create($arr);
if(! $result['success']) { if(! $result['success']) {
notice($result['message']); notice($result['message']);
@ -89,7 +89,7 @@ function register_post(App $a) {
// Only send a password mail when the password wasn't manually provided // Only send a password mail when the password wasn't manually provided
if (!x($_POST,'password1') || !x($_POST,'confirm')) { if (!x($_POST,'password1') || !x($_POST,'confirm')) {
$res = send_register_open_eml( $res = User::sendRegisterOpenEmail(
$user['email'], $user['email'],
$a->config['sitename'], $a->config['sitename'],
System::baseUrl(), System::baseUrl(),
@ -159,7 +159,7 @@ function register_post(App $a) {
)); ));
} }
// send notification to the user, that the registration is pending // send notification to the user, that the registration is pending
send_register_pending_eml( User::sendRegisterPendingEmail(
$user['email'], $user['email'],
$a->config['sitename'], $a->config['sitename'],
$user['username']); $user['username']);

47
mod/regmod.php
View File

@ -6,11 +6,10 @@ use Friendica\Core\System;
use Friendica\Core\Worker; use Friendica\Core\Worker;
use Friendica\Database\DBM; use Friendica\Database\DBM;
require_once('include/enotify.php'); require_once 'include/enotify.php';
require_once('include/user.php');
function user_allow($hash) {
function user_allow($hash)
{
$a = get_app(); $a = get_app();
$register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1", $register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1",
@ -18,7 +17,7 @@ function user_allow($hash) {
); );
if (! DBM::is_result($register)) { if (!DBM::is_result($register)) {
return false; return false;
} }
@ -26,7 +25,7 @@ function user_allow($hash) {
intval($register[0]['uid']) intval($register[0]['uid'])
); );
if (! DBM::is_result($user)) { if (!DBM::is_result($user)) {
killme(); killme();
} }
@ -44,14 +43,14 @@ function user_allow($hash) {
); );
if (DBM::is_result($r) && $r[0]['net-publish']) { if (DBM::is_result($r) && $r[0]['net-publish']) {
$url = System::baseUrl() . '/profile/' . $user[0]['nickname']; $url = System::baseUrl() . '/profile/' . $user[0]['nickname'];
if ($url && strlen(Config::get('system','directory'))) { if ($url && strlen(Config::get('system', 'directory'))) {
Worker::add(PRIORITY_LOW, "Directory", $url); Worker::add(PRIORITY_LOW, "Directory", $url);
} }
} }
push_lang($register[0]['language']); push_lang($register[0]['language']);
send_register_open_eml( User::sendRegisterOpenEmail(
$user[0]['email'], $user[0]['email'],
$a->config['sitename'], $a->config['sitename'],
System::baseUrl(), System::baseUrl(),
@ -60,20 +59,17 @@ function user_allow($hash) {
pop_lang(); pop_lang();
if($res) { if ($res) {
info( t('Account approved.') . EOL ); info(t('Account approved.') . EOL);
return true; return true;
} }
} }
// This does not have to go through user_remove() and save the nickname // This does not have to go through user_remove() and save the nickname
// permanently against re-registration, as the person was not yet // permanently against re-registration, as the person was not yet
// allowed to have friends on this system // allowed to have friends on this system
function user_deny($hash)
function user_deny($hash) { {
$register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1", $register = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1",
dbesc($hash) dbesc($hash)
); );
@ -91,23 +87,22 @@ function user_deny($hash) {
notice(sprintf(t('Registration revoked for %s'), $user[0]['username']) . EOL); notice(sprintf(t('Registration revoked for %s'), $user[0]['username']) . EOL);
return true; return true;
} }
function regmod_content(App $a) { function regmod_content(App $a)
{
global $lang; global $lang;
$_SESSION['return_url'] = $a->cmd; $_SESSION['return_url'] = $a->cmd;
if (! local_user()) { if (!local_user()) {
info( t('Please login.') . EOL); info(t('Please login.') . EOL);
$o .= '<br /><br />' . login(($a->config['register_policy'] == REGISTER_CLOSED) ? 0 : 1); $o .= '<br /><br />' . login(($a->config['register_policy'] == REGISTER_CLOSED) ? 0 : 1);
return $o; return $o;
} }
if ((!is_site_admin()) || (x($_SESSION,'submanage') && intval($_SESSION['submanage']))) { if ((!is_site_admin()) || (x($_SESSION, 'submanage') && intval($_SESSION['submanage']))) {
notice( t('Permission denied.') . EOL); notice(t('Permission denied.') . EOL);
return ''; return '';
} }
@ -115,20 +110,18 @@ function regmod_content(App $a) {
killme(); killme();
} }
$cmd = $a->argv[1]; $cmd = $a->argv[1];
$hash = $a->argv[2]; $hash = $a->argv[2];
if ($cmd === 'deny') { if ($cmd === 'deny') {
user_deny($hash); user_deny($hash);
goaway(System::baseUrl()."/admin/users/"); goaway(System::baseUrl() . "/admin/users/");
killme(); killme();
} }
if ($cmd === 'allow') { if ($cmd === 'allow') {
user_allow($hash); user_allow($hash);
goaway(System::baseUrl()."/admin/users/"); goaway(System::baseUrl() . "/admin/users/");
killme(); killme();
} }
} }

442
src/Model/User.php
View File

@ -7,19 +7,41 @@
namespace Friendica\Model; namespace Friendica\Model;
use Friendica\Core\Config;
use Friendica\Core\System; use Friendica\Core\System;
use Friendica\Core\Worker; use Friendica\Core\Worker;
use Friendica\Database\DBM; use Friendica\Database\DBM;
use Friendica\Object\Contact;
use Friendica\Object\Photo;
use dba; use dba;
require_once 'boot.php'; require_once 'boot.php';
require_once 'include/crypto.php';
require_once 'include/enotify.php';
require_once 'include/group.php';
require_once 'include/network.php';
require_once 'library/openid.php';
require_once 'include/pgettext.php';
require_once 'include/plugin.php'; require_once 'include/plugin.php';
require_once 'include/text.php';
/** /**
* @brief This class handles User related functions * @brief This class handles User related functions
*/ */
class User class User
{ {
/**
* @brief Authenticate a user with a clear text password
*
* User info can be any of the following:
* - User DB object
* - User Id
* - User email or username or nickname
* - User array with at least the uid and the hashed password
*
* @param mixed $user_info
* @param string $password
* @return boolean
*/
public static function authenticate($user_info, $password) public static function authenticate($user_info, $password)
{ {
if (is_object($user_info)) { if (is_object($user_info)) {
@ -66,6 +88,424 @@ class User
return $user['uid']; return $user['uid'];
} }
/**
* @brief Catch-all user creation function
*
* Creates a user from the provided data array, either form fields or OpenID.
* Required: { username, nickname, email } or { openid_url }
*
* Performs the following:
* - Sends to the OpenId auth URL (if relevant)
* - Creates new key pairs for crypto
* - Create self-contact
* - Create profile image
*
* @param array $data
* @return string
*/
public static function create(array $data)
{
$a = get_app();
$result = array('success' => false, 'user' => null, 'password' => '', 'message' => '');
$using_invites = Config::get('system', 'invitation_only');
$num_invites = Config::get('system', 'number_invites');
$invite_id = x($data, 'invite_id') ? notags(trim($data['invite_id'])) : '';
$username = x($data, 'username') ? notags(trim($data['username'])) : '';
$nickname = x($data, 'nickname') ? notags(trim($data['nickname'])) : '';
$email = x($data, 'email') ? notags(trim($data['email'])) : '';
$openid_url = x($data, 'openid_url') ? notags(trim($data['openid_url'])) : '';
$photo = x($data, 'photo') ? notags(trim($data['photo'])) : '';
$password = x($data, 'password') ? trim($data['password']) : '';
$password1 = x($data, 'password1') ? trim($data['password1']) : '';
$confirm = x($data, 'confirm') ? trim($data['confirm']) : '';
$blocked = x($data, 'blocked') ? intval($data['blocked']) : 0;
$verified = x($data, 'verified') ? intval($data['verified']) : 0;
$publish = x($data, 'profile_publish_reg') && intval($data['profile_publish_reg']) ? 1 : 0;
$netpublish = strlen(Config::get('system', 'directory')) ? $publish : 0;
if ($password1 != $confirm) {
$result['message'] .= t('Passwords do not match. Password unchanged.') . EOL;
return $result;
} elseif ($password1 != "") {
$password = $password1;
}
$tmp_str = $openid_url;
if ($using_invites) {
if (!$invite_id) {
$result['message'] .= t('An invitation is required.') . EOL;
return $result;
}
$r = q("SELECT * FROM `register` WHERE `hash` = '%s' LIMIT 1", dbesc($invite_id));
if (!results($r)) {
$result['message'] .= t('Invitation could not be verified.') . EOL;
return $result;
}
}
if (!x($username) || !x($email) || !x($nickname)) {
if ($openid_url) {
if (!validate_url($tmp_str)) {
$result['message'] .= t('Invalid OpenID url') . EOL;
return $result;
}
$_SESSION['register'] = 1;
$_SESSION['openid'] = $openid_url;
$openid = new LightOpenID;
$openid->identity = $openid_url;
$openid->returnUrl = System::baseUrl() . '/openid';
$openid->required = array('namePerson/friendly', 'contact/email', 'namePerson');
$openid->optional = array('namePerson/first', 'media/image/aspect11', 'media/image/default');
try {
$authurl = $openid->authUrl();
} catch (Exception $e) {
$result['message'] .= t("We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.") . EOL . EOL . t("The error message was:") . $e->getMessage() . EOL;
return $result;
}
goaway($authurl);
// NOTREACHED
}
notice(t('Please enter the required information.') . EOL);
return;
}
if (!validate_url($tmp_str)) {
$openid_url = '';
}
$err = '';
// collapse multiple spaces in name
$username = preg_replace('/ +/', ' ', $username);
if (mb_strlen($username) > 48) {
$result['message'] .= t('Please use a shorter name.') . EOL;
}
if (mb_strlen($username) < 3) {
$result['message'] .= t('Name too short.') . EOL;
}
// So now we are just looking for a space in the full name.
$loose_reg = Config::get('system', 'no_regfullname');
if (!$loose_reg) {
$username = mb_convert_case($username, MB_CASE_TITLE, 'UTF-8');
if (!strpos($username, ' ')) {
$result['message'] .= t("That doesn't appear to be your full \x28First Last\x29 name.") . EOL;
}
}
if (!allowed_email($email)) {
$result['message'] .= t('Your email domain is not among those allowed on this site.') . EOL;
}
if (!valid_email($email) || !validate_email($email)) {
$result['message'] .= t('Not a valid email address.') . EOL;
}
// Disallow somebody creating an account using openid that uses the admin email address,
// since openid bypasses email verification. We'll allow it if there is not yet an admin account.
$adminlist = explode(",", str_replace(" ", "", strtolower($a->config['admin_email'])));
//if((x($a->config,'admin_email')) && (strcasecmp($email,$a->config['admin_email']) == 0) && strlen($openid_url)) {
if (x($a->config, 'admin_email') && in_array(strtolower($email), $adminlist) && strlen($openid_url)) {
$r = q("SELECT * FROM `user` WHERE `email` = '%s' LIMIT 1",
dbesc($email)
);
if (DBM::is_result($r)) {
$result['message'] .= t('Cannot use that email.') . EOL;
}
}
$nickname = $data['nickname'] = strtolower($nickname);
if (!preg_match("/^[a-z0-9][a-z0-9\_]*$/", $nickname)) {
$result['message'] .= t('Your "nickname" can only contain "a-z", "0-9" and "_".') . EOL;
}
$r = q("SELECT `uid` FROM `user`
WHERE `nickname` = '%s' LIMIT 1",
dbesc($nickname)
);
if (DBM::is_result($r)) {
$result['message'] .= t('Nickname is already registered. Please choose another.') . EOL;
}
// Check deleted accounts that had this nickname. Doesn't matter to us,
// but could be a security issue for federated platforms.
$r = q("SELECT * FROM `userd`
WHERE `username` = '%s' LIMIT 1",
dbesc($nickname)
);
if (DBM::is_result($r)) {
$result['message'] .= t('Nickname was once registered here and may not be re-used. Please choose another.') . EOL;
}
if (strlen($result['message'])) {
return $result;
}
$new_password = strlen($password) ? $password : autoname(6) . mt_rand(100, 9999);
$new_password_encoded = hash('whirlpool', $new_password);
$result['password'] = $new_password;
$keys = new_keypair(4096);
if ($keys === false) {
$result['message'] .= t('SERIOUS ERROR: Generation of security keys failed.') . EOL;
return $result;
}
$prvkey = $keys['prvkey'];
$pubkey = $keys['pubkey'];
// Create another keypair for signing/verifying salmon protocol messages.
$sres = new_keypair(512);
$sprvkey = $sres['prvkey'];
$spubkey = $sres['pubkey'];
$r = q("INSERT INTO `user` (`guid`, `username`, `password`, `email`, `openid`, `nickname`,
`pubkey`, `prvkey`, `spubkey`, `sprvkey`, `register_date`, `verified`, `blocked`, `timezone`, `default-location`)
VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, 'UTC', '')",
dbesc(generate_user_guid()),
dbesc($username),
dbesc($new_password_encoded),
dbesc($email),
dbesc($openid_url),
dbesc($nickname),
dbesc($pubkey),
dbesc($prvkey),
dbesc($spubkey),
dbesc($sprvkey),
dbesc(datetime_convert()),
intval($verified),
intval($blocked)
);
if ($r) {
$r = q("SELECT * FROM `user`
WHERE `username` = '%s' AND `password` = '%s' LIMIT 1",
dbesc($username),
dbesc($new_password_encoded)
);
if (DBM::is_result($r)) {
$u = $r[0];
$newuid = intval($r[0]['uid']);
}
} else {
$result['message'] .= t('An error occurred during registration. Please try again.') . EOL;
return $result;
}
/**
* if somebody clicked submit twice very quickly, they could end up with two accounts
* due to race condition. Remove this one.
*/
$r = q("SELECT `uid` FROM `user`
WHERE `nickname` = '%s' ",
dbesc($nickname)
);
if (DBM::is_result($r) && count($r) > 1 && $newuid) {
$result['message'] .= t('Nickname is already registered. Please choose another.') . EOL;
dba::delete('user', array('uid' => $newuid));
return $result;
}
if (x($newuid) !== false) {
$r = q("INSERT INTO `profile` ( `uid`, `profile-name`, `is-default`, `name`, `photo`, `thumb`, `publish`, `net-publish` )
VALUES ( %d, '%s', %d, '%s', '%s', '%s', %d, %d ) ",
intval($newuid),
t('default'),
1,
dbesc($username),
dbesc(System::baseUrl() . "/photo/profile/{$newuid}.jpg"),
dbesc(System::baseUrl() . "/photo/avatar/{$newuid}.jpg"),
intval($publish),
intval($netpublish)
);
if ($r === false) {
$result['message'] .= t('An error occurred creating your default profile. Please try again.') . EOL;
// Start fresh next time.
dba::delete('user', array('uid' => $newuid));
return $result;
}
// Create the self contact
Contact::createSelfFromUserId($newuid);
// Create a group with no members. This allows somebody to use it
// right away as a default group for new contacts.
group_add($newuid, t('Friends'));
$r = q("SELECT `id` FROM `group` WHERE `uid` = %d AND `name` = '%s'",
intval($newuid),
dbesc(t('Friends'))
);
if (DBM::is_result($r)) {
$def_gid = $r[0]['id'];
q("UPDATE `user` SET `def_gid` = %d WHERE `uid` = %d",
intval($r[0]['id']),
intval($newuid)
);
}
if (Config::get('system', 'newuser_private') && $def_gid) {
q("UPDATE `user` SET `allow_gid` = '%s' WHERE `uid` = %d",
dbesc("<" . $def_gid . ">"),
intval($newuid)
);
}
}
// if we have no OpenID photo try to look up an avatar
if (!strlen($photo)) {
$photo = avatar_img($email);
}
// unless there is no avatar-plugin loaded
if (strlen($photo)) {
$photo_failure = false;
$filename = basename($photo);
$img_str = fetch_url($photo, true);
// guess mimetype from headers or filename
$type = Photo::guessImageType($photo, true);
$img = new Photo($img_str, $type);
if ($img->isValid()) {
$img->scaleImageSquare(175);
$hash = photo_new_resource();
$r = $img->store($newuid, 0, $hash, $filename, t('Profile Photos'), 4);
if ($r === false) {
$photo_failure = true;
}
$img->scaleImage(80);
$r = $img->store($newuid, 0, $hash, $filename, t('Profile Photos'), 5);
if ($r === false) {
$photo_failure = true;
}
$img->scaleImage(48);
$r = $img->store($newuid, 0, $hash, $filename, t('Profile Photos'), 6);
if ($r === false) {
$photo_failure = true;
}
if (!$photo_failure) {
q("UPDATE `photo` SET `profile` = 1 WHERE `resource-id` = '%s' ",
dbesc($hash)
);
}
}
}
call_hooks('register_account', $newuid);
$result['success'] = true;
$result['user'] = $u;
return $result;
}
/**
* @brief Sends pending registration confiŕmation email
*
* @param string $email
* @param string $sitename
* @param string $username
* @return NULL|boolean from notification() and email() inherited
*/
public static function sendRegisterPendingEmail($email, $sitename, $username)
{
$body = deindent(t('
Dear %1$s,
Thank you for registering at %2$s. Your account is pending for approval by the administrator.
'));
$body = sprintf($body, $username, $sitename);
return notification(array(
'type' => SYSTEM_EMAIL,
'to_email' => $email,
'subject'=> sprintf( t('Registration at %s'), $sitename),
'body' => $body));
}
/**
* @brief Sends registration confirmation
*
* It's here as a function because the mail is sent from different parts
*
* @param string $email
* @param string $sitename
* @param string $siteurl
* @param string $username
* @param string $password
* @return NULL|boolean from notification() and email() inherited
*/
public static function sendRegisterOpenEmail($email, $sitename, $siteurl, $username, $password)
{
$preamble = deindent(t('
Dear %1$s,
Thank you for registering at %2$s. Your account has been created.
'));
$body = deindent(t('
The login details are as follows:
Site Location: %3$s
Login Name: %1$s
Password: %5$s
You may change your password from your account "Settings" page after logging
in.
Please take a few moments to review the other account settings on that page.
You may also wish to add some basic information to your default profile
(on the "Profiles" page) so that other people can easily find you.
We recommend setting your full name, adding a profile photo,
adding some profile "keywords" (very useful in making new friends) - and
perhaps what country you live in; if you do not wish to be more specific
than that.
We fully respect your right to privacy, and none of these items are necessary.
If you are new and do not know anybody here, they may help
you to make some new and interesting friends.
Thank you and welcome to %2$s.'));
$preamble = sprintf($preamble, $username, $sitename);
$body = sprintf($body, $email, $sitename, $siteurl, $username, $password);
return notification(array(
'type' => SYSTEM_EMAIL,
'to_email' => $email,
'subject'=> sprintf( t('Registration details for %s'), $sitename),
'preamble'=> $preamble,
'body' => $body));
}
/** /**
* @param object $uid user to remove * @param object $uid user to remove
* @return void * @return void

46
src/Object/Contact.php
View File

@ -28,6 +28,52 @@ require_once 'include/text.php';
*/ */
class Contact extends BaseObject class Contact extends BaseObject
{ {
/**
* Creates the self-contact for the provided user id
*
* @param int $uid
* @return bool Operation success
*/
public static function createSelfFromUserId($uid)
{
// Only create the entry if it doesn't exist yet
if (dba::exists('contact', ['uid' => intval($uid), 'self'])) {
return true;
}
$user = dba::select('user', ['uid', 'username', 'nickname'], ['uid' => intval($uid)], ['limit' => 1]);
if (!DBM::is_result($user)) {
return false;
}
$return = dba::insert('contact', [
'uid' => $user['uid'],
'created' => datetime_convert(),
'self' => 1,
'name' => $user['username'],
'nick' => $user['nickname'],
'photo' => System::baseUrl() . '/photo/profile/' . $user['uid'] . '.jpg',
'thumb' => System::baseUrl() . '/photo/avatar/' . $user['uid'] . '.jpg',
'micro' => System::baseUrl() . '/photo/micro/' . $user['uid'] . '.jpg',
'blocked' => 0,
'pending' => 0,
'url' => System::baseUrl() . '/profile/' . $user['nickname'],
'nurl' => normalise_link(System::baseUrl() . '/profile/' . $user['nickname']),
'addr' => $user['nickname'] . '@' . substr(System::baseUrl(), strpos(System::baseUrl(), '://') + 3),
'request' => System::baseUrl() . '/dfrn_request/' . $user['nickname'],
'notify' => System::baseUrl() . '/dfrn_notify/' . $user['nickname'],
'poll' => System::baseUrl() . '/dfrn_poll/' . $user['nickname'],
'confirm' => System::baseUrl() . '/dfrn_confirm/' . $user['nickname'],
'poco' => System::baseUrl() . '/poco/' . $user['nickname'],
'name-date' => datetime_convert(),
'uri-date' => datetime_convert(),
'avatar-date' => datetime_convert(),
'closeness' => 0
]);
return $return;
}
/** /**
* @brief Marks a contact for removal * @brief Marks a contact for removal
* *

57
src/Worker/CronJobs.php
View File

@ -1,4 +1,5 @@
<?php <?php
/** /**
* @file src/worker/CronJobs.php * @file src/worker/CronJobs.php
*/ */
@ -11,25 +12,27 @@ use Friendica\Core\Config;
use Friendica\Database\DBM; use Friendica\Database\DBM;
use Friendica\Model\GlobalContact; use Friendica\Model\GlobalContact;
use Friendica\Network\Probe; use Friendica\Network\Probe;
use Friendica\Object\Contact;
use Friendica\Protocol\PortableContact; use Friendica\Protocol\PortableContact;
use dba; use dba;
class CronJobs { class CronJobs
public static function execute($command = ''){ {
public static function execute($command = '')
{
global $a; global $a;
require_once 'include/datetime.php'; require_once 'include/datetime.php';
require_once 'include/post_update.php'; require_once 'include/post_update.php';
require_once 'mod/nodeinfo.php'; require_once 'mod/nodeinfo.php';
require_once 'include/photos.php'; require_once 'include/photos.php';
require_once 'include/user.php';
// No parameter set? So return // No parameter set? So return
if ($command == '') { if ($command == '') {
return; return;
} }
logger("Starting cronjob ".$command, LOGGER_DEBUG); logger("Starting cronjob " . $command, LOGGER_DEBUG);
// Call possible post update functions // Call possible post update functions
// see include/post_update.php for more details // see include/post_update.php for more details
@ -78,7 +81,7 @@ class CronJobs {
return; return;
} }
logger("Xronjob ".$command." is unknown.", LOGGER_DEBUG); logger("Xronjob " . $command . " is unknown.", LOGGER_DEBUG);
return; return;
} }
@ -86,7 +89,8 @@ class CronJobs {
/** /**
* @brief Update the cached values for the number of photo albums per user * @brief Update the cached values for the number of photo albums per user
*/ */
private static function updatePhotoAlbums() { private static function updatePhotoAlbums()
{
$r = q("SELECT `uid` FROM `user` WHERE NOT `account_expired` AND NOT `account_removed`"); $r = q("SELECT `uid` FROM `user` WHERE NOT `account_expired` AND NOT `account_removed`");
if (!DBM::is_result($r)) { if (!DBM::is_result($r)) {
return; return;
@ -100,7 +104,8 @@ class CronJobs {
/** /**
* @brief Expire and remove user entries * @brief Expire and remove user entries
*/ */
private static function expireAndRemoveUsers() { private static function expireAndRemoveUsers()
{
// expire any expired accounts // expire any expired accounts
q("UPDATE user SET `account_expired` = 1 where `account_expired` = 0 q("UPDATE user SET `account_expired` = 1 where `account_expired` = 0
AND `account_expires_on` > '%s' AND `account_expires_on` > '%s'
@ -120,9 +125,9 @@ class CronJobs {
* *
* @param App $a * @param App $a
*/ */
private static function clearCache(App $a) { private static function clearCache(App $a)
{
$last = Config::get('system','cache_last_cleared'); $last = Config::get('system', 'cache_last_cleared');
if ($last) { if ($last) {
$next = $last + (3600); // Once per hour $next = $last + (3600); // Once per hour
@ -142,16 +147,16 @@ class CronJobs {
clear_cache(); clear_cache();
// clear cache for photos // clear cache for photos
clear_cache($a->get_basepath(), $a->get_basepath()."/photo"); clear_cache($a->get_basepath(), $a->get_basepath() . "/photo");
// clear smarty cache // clear smarty cache
clear_cache($a->get_basepath()."/view/smarty3/compiled", $a->get_basepath()."/view/smarty3/compiled"); clear_cache($a->get_basepath() . "/view/smarty3/compiled", $a->get_basepath() . "/view/smarty3/compiled");
// clear cache for image proxy // clear cache for image proxy
if (!Config::get("system", "proxy_disabled")) { if (!Config::get("system", "proxy_disabled")) {
clear_cache($a->get_basepath(), $a->get_basepath()."/proxy"); clear_cache($a->get_basepath(), $a->get_basepath() . "/proxy");
$cachetime = Config::get('system','proxy_cache_time'); $cachetime = Config::get('system', 'proxy_cache_time');
if (!$cachetime) { if (!$cachetime) {
$cachetime = PROXY_DEFAULT_TIME; $cachetime = PROXY_DEFAULT_TIME;
} }
@ -166,13 +171,13 @@ class CronJobs {
dba::delete('parsed_url', array("`created` < NOW() - INTERVAL 3 MONTH")); dba::delete('parsed_url', array("`created` < NOW() - INTERVAL 3 MONTH"));
// Maximum table size in megabyte // Maximum table size in megabyte
$max_tablesize = intval(Config::get('system','optimize_max_tablesize')) * 1000000; $max_tablesize = intval(Config::get('system', 'optimize_max_tablesize')) * 1000000;
if ($max_tablesize == 0) { if ($max_tablesize == 0) {
$max_tablesize = 100 * 1000000; // Default are 100 MB $max_tablesize = 100 * 1000000; // Default are 100 MB
} }
if ($max_tablesize > 0) { if ($max_tablesize > 0) {
// Minimum fragmentation level in percent // Minimum fragmentation level in percent
$fragmentation_level = intval(Config::get('system','optimize_fragmentation')) / 100; $fragmentation_level = intval(Config::get('system', 'optimize_fragmentation')) / 100;
if ($fragmentation_level == 0) { if ($fragmentation_level == 0) {
$fragmentation_level = 0.3; // Default value is 30% $fragmentation_level = 0.3; // Default value is 30%
} }
@ -194,7 +199,7 @@ class CronJobs {
// Calculate fragmentation // Calculate fragmentation
$fragmentation = $table["Data_free"] / ($table["Data_length"] + $table["Index_length"]); $fragmentation = $table["Data_free"] / ($table["Data_length"] + $table["Index_length"]);
logger("Table ".$table["Name"]." - Fragmentation level: ".round($fragmentation * 100, 2), LOGGER_DEBUG); logger("Table " . $table["Name"] . " - Fragmentation level: " . round($fragmentation * 100, 2), LOGGER_DEBUG);
// Don't optimize tables that needn't to be optimized // Don't optimize tables that needn't to be optimized
if ($fragmentation < $fragmentation_level) { if ($fragmentation < $fragmentation_level) {
@ -202,12 +207,12 @@ class CronJobs {
} }
// So optimize it // So optimize it
logger("Optimize Table ".$table["Name"], LOGGER_DEBUG); logger("Optimize Table " . $table["Name"], LOGGER_DEBUG);
q("OPTIMIZE TABLE `%s`", dbesc($table["Name"])); q("OPTIMIZE TABLE `%s`", dbesc($table["Name"]));
} }
} }
Config::set('system','cache_last_cleared', time()); Config::set('system', 'cache_last_cleared', time());
} }
/** /**
@ -215,8 +220,8 @@ class CronJobs {
* *
* @param App $a * @param App $a
*/ */
private static function repairDiaspora(App $a) { private static function repairDiaspora(App $a)
{
$starttime = time(); $starttime = time();
$r = q("SELECT `id`, `url` FROM `contact` $r = q("SELECT `id`, `url` FROM `contact`
@ -241,7 +246,7 @@ class CronJobs {
continue; continue;
} }
logger("Repair contact ".$contact["id"]." ".$contact["url"], LOGGER_DEBUG); logger("Repair contact " . $contact["id"] . " " . $contact["url"], LOGGER_DEBUG);
q("UPDATE `contact` SET `batch` = '%s', `notify` = '%s', `poll` = '%s', pubkey = '%s' WHERE `id` = %d", q("UPDATE `contact` SET `batch` = '%s', `notify` = '%s', `poll` = '%s', pubkey = '%s' WHERE `id` = %d",
dbesc($data["batch"]), dbesc($data["notify"]), dbesc($data["poll"]), dbesc($data["pubkey"]), dbesc($data["batch"]), dbesc($data["notify"]), dbesc($data["poll"]), dbesc($data["pubkey"]),
intval($contact["id"])); intval($contact["id"]));
@ -252,15 +257,15 @@ class CronJobs {
* @brief Do some repairs in database entries * @brief Do some repairs in database entries
* *
*/ */
private static function repairDatabase() { private static function repairDatabase()
{
// Sometimes there seem to be issues where the "self" contact vanishes. // Sometimes there seem to be issues where the "self" contact vanishes.
// We haven't found the origin of the problem by now. // We haven't found the origin of the problem by now.
$r = q("SELECT `uid` FROM `user` WHERE NOT EXISTS (SELECT `uid` FROM `contact` WHERE `contact`.`uid` = `user`.`uid` AND `contact`.`self`)"); $r = q("SELECT `uid` FROM `user` WHERE NOT EXISTS (SELECT `uid` FROM `contact` WHERE `contact`.`uid` = `user`.`uid` AND `contact`.`self`)");
if (DBM::is_result($r)) { if (DBM::is_result($r)) {
foreach ($r AS $user) { foreach ($r AS $user) {
logger('Create missing self contact for user '.$user['uid']); logger('Create missing self contact for user ' . $user['uid']);
user_create_self_contact($user['uid']); Contact::createSelfFromUserId($user['uid']);
} }
} }