<?php

/**

 * @file

 * Enables the user registration and login system.

 */

/**

 * Maximum length of username text field.

 */

define('USERNAME_MAX_LENGTH', 60);

/**

 * Maximum length of user e-mail text field.

 */

define('EMAIL_MAX_LENGTH', 254);

/**

 * Only administrators can create user accounts.

 */

define('USER_REGISTER_ADMINISTRATORS_ONLY', 0);

/**

 * Visitors can create their own accounts.

 */

define('USER_REGISTER_VISITORS', 1);

/**

 * Visitors can create accounts, but they don't become active without

 * administrative approval.

 */

define('USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL', 2);

/**

 * Implements hook_help().

 */

function user_help($path, $arg) {

  global $user;

  switch ($path) {

    case 'admin/help#user':

      $output = '';

      $output .= '<h3>' . t('About') . '</h3>';

      $output .= '<p>' . t('The User module allows users to register, log in, and log out. It also allows users with proper permissions to manage user roles (used to classify users) and permissions associated with those roles. For more information, see the online handbook entry for <a href="@user">User module</a>.', array('@user' => 'http://drupal.org/documentation/modules/user')) . '</p>';

      $output .= '<h3>' . t('Uses') . '</h3>';

      $output .= '<dl>';

      $output .= '<dt>' . t('Creating and managing users') . '</dt>';

      $output .= '<dd>' . t('The User module allows users with the appropriate <a href="@permissions">permissions</a> to create user accounts through the <a href="@people">People administration page</a>, where they can also assign users to one or more roles, and block or delete user accounts. If allowed, users without accounts (anonymous users) can create their own accounts on the <a href="@register">Create new account</a> page.', array('@permissions' => url('admin/people/permissions', array('fragment' => 'module-user')), '@people' => url('admin/people'), '@register' => url('user/register'))) . '</dd>';

      $output .= '<dt>' . t('User roles and permissions') . '</dt>';

      $output .= '<dd>' . t('<em>Roles</em> are used to group and classify users; each user can be assigned one or more roles. By default there are two roles: <em>anonymous user</em> (users that are not logged in) and <em>authenticated user</em> (users that are registered and logged in). Depending on choices you made when you installed Drupal, the installation process may have defined more roles, and you can create additional custom roles on the <a href="@roles">Roles page</a>. After creating roles, you can set permissions for each role on the <a href="@permissions_user">Permissions page</a>. Granting a permission allows users who have been assigned a particular role to perform an action on the site, such as viewing a particular type of content, editing or creating content, administering settings for a particular module, or using a particular function of the site (such as search).', array('@permissions_user' => url('admin/people/permissions'), '@roles' => url('admin/people/permissions/roles'))) . '</dd>';

      $output .= '<dt>' . t('Account settings') . '</dt>';

      $output .= '<dd>' . t('The <a href="@accounts">Account settings page</a> allows you to manage settings for the displayed name of the anonymous user role, personal contact forms, user registration, and account cancellation. On this page you can also manage settings for account personalization (including signatures and user pictures), and adapt the text for the e-mail messages that are sent automatically during the user registration process.', array('@accounts'  => url('admin/config/people/accounts'))) . '</dd>';

      $output .= '</dl>';

      return $output;

    case 'admin/people/create':

      return '<p>' . t("This web page allows administrators to register new users. Users' e-mail addresses and usernames must be unique.") . '</p>';

    case 'admin/people/permissions':

      return '<p>' . t('Permissions let you control what users can do and see on your site. You can define a specific set of permissions for each role. (See the <a href="@role">Roles</a> page to create a role). Two important roles to consider are Authenticated Users and Administrators. Any permissions granted to the Authenticated Users role will be given to any user who can log into your site. You can make any role the Administrator role for the site, meaning this will be granted all new permissions automatically. You can do this on the <a href="@settings">User Settings</a> page. You should be careful to ensure that only trusted users are given this access and level of control of your site.', array('@role' => url('admin/people/permissions/roles'), '@settings' => url('admin/config/people/accounts'))) . '</p>';

    case 'admin/people/permissions/roles':

      $output = '<p>' . t('Roles allow you to fine tune the security and administration of Drupal. A role defines a group of users that have certain privileges as defined on the <a href="@permissions">permissions page</a>. Examples of roles include: anonymous user, authenticated user, moderator, administrator and so on. In this area you will define the names and order of the roles on your site. It is recommended to order your roles from least permissive (anonymous user) to most permissive (administrator). To delete a role choose "edit role".', array('@permissions' => url('admin/people/permissions'))) . '</p>';

      $output .= '<p>' . t('By default, Drupal comes with two user roles:') . '</p>';

      $output .= '<ul>';

      $output .= '<li>' . t("Anonymous user: this role is used for users that don't have a user account or that are not authenticated.") . '</li>';

      $output .= '<li>' . t('Authenticated user: this role is automatically granted to all logged in users.') . '</li>';

      $output .= '</ul>';

      return $output;

    case 'admin/config/people/accounts/fields':

      return '<p>' . t('This form lets administrators add, edit, and arrange fields for storing user data.') . '</p>';

    case 'admin/config/people/accounts/display':

      return '<p>' . t('This form lets administrators configure how fields should be displayed when rendering a user profile page.') . '</p>';

    case 'admin/people/search':

      return '<p>' . t('Enter a simple pattern ("*" may be used as a wildcard match) to search for a username or e-mail address. For example, one may search for "br" and Drupal might return "brian", "brad", and "brenda@example.com".') . '</p>';

  }

}

/**

 * Invokes a user hook in every module.

 *

 * We cannot use module_invoke() for this, because the arguments need to

 * be passed by reference.

 *

 * @param $type

 *   A text string that controls which user hook to invoke.  Valid choices are:

 *   - cancel: Invokes hook_user_cancel().

 *   - insert: Invokes hook_user_insert().

 *   - login: Invokes hook_user_login().

 *   - presave: Invokes hook_user_presave().

 *   - update: Invokes hook_user_update().

 * @param $edit

 *   An associative array variable containing form values to be passed

 *   as the first parameter of the hook function.

 * @param $account

 *   The user account object to be passed as the second parameter of the hook

 *   function.

 * @param $category

 *   The category of user information being acted upon.

 */

function user_module_invoke($type, &$edit, $account, $category = NULL) {

  foreach (module_implements('user_' . $type) as $module) {

    $function = $module . '_user_' . $type;

    $function($edit, $account, $category);

  }

}

/**

 * Implements hook_theme().

 */

function user_theme() {

  return array(

    'user_picture' => array(

      'variables' => array('account' => NULL),

      'template' => 'user-picture',

    ),

    'user_profile' => array(

      'render element' => 'elements',

      'template' => 'user-profile',

      'file' => 'user.pages.inc',

    ),

    'user_profile_category' => array(

      'render element' => 'element',

      'template' => 'user-profile-category',

      'file' => 'user.pages.inc',

    ),

    'user_profile_item' => array(

      'render element' => 'element',

      'template' => 'user-profile-item',

      'file' => 'user.pages.inc',

    ),

    'user_list' => array(

      'variables' => array('users' => NULL, 'title' => NULL),

    ),

    'user_admin_permissions' => array(

      'render element' => 'form',

      'file' => 'user.admin.inc',

    ),

    'user_admin_roles' => array(

      'render element' => 'form',

      'file' => 'user.admin.inc',

    ),

    'user_permission_description' => array(

      'variables' => array('permission_item' => NULL, 'hide' => NULL),

      'file' => 'user.admin.inc',

    ),

    'user_signature' => array(

      'variables' => array('signature' => NULL),

    ),

  );

}

/**

 * Implements hook_entity_info().

 */

function user_entity_info() {

  $return = array(

    'user' => array(

      'label' => t('User'),

      'controller class' => 'UserController',

      'base table' => 'users',

      'uri callback' => 'user_uri',

      'label callback' => 'format_username',

      'fieldable' => TRUE,

      // $user->language is only the preferred user language for the user

      // interface textual elements. As it is not necessarily related to the

      // language assigned to fields, we do not define it as the entity language

      // key.

      'entity keys' => array(

        'id' => 'uid',

      ),

      'bundles' => array(

        'user' => array(

          'label' => t('User'),

          'admin' => array(

            'path' => 'admin/config/people/accounts',

            'access arguments' => array('administer users'),

          ),

        ),

      ),

      'view modes' => array(

        'full' => array(

          'label' => t('User account'),

          'custom settings' => FALSE,

        ),

      ),

    ),

  );

  return $return;

}

/**

 * Implements callback_entity_info_uri().

 */

function user_uri($user) {

  return array(

    'path' => 'user/' . $user->uid,

  );

}

/**

 * Implements hook_field_info_alter().

 */

function user_field_info_alter(&$info) {

  // Add the 'user_register_form' instance setting to all field types.

  foreach ($info as $field_type => &$field_type_info) {

    $field_type_info += array('instance_settings' => array());

    $field_type_info['instance_settings'] += array(

      'user_register_form' => FALSE,

    );

  }

}

/**

 * Implements hook_field_extra_fields().

 */

function user_field_extra_fields() {

  $return['user']['user'] = array(

    'form' => array(

      'account' => array(

        'label' => t('User name and password'),

        'description' => t('User module account form elements.'),

        'weight' => -10,

      ),

      'timezone' => array(

        'label' => t('Timezone'),

        'description' => t('User module timezone form element.'),

        'weight' => 6,

      ),

    ),

    'display' => array(

      'summary' => array(

        'label' => t('History'),

        'description' => t('User module history view element.'),

        'weight' => 5,

      ),

    ),

  );

  return $return;

}

/**

 * Fetches a user object based on an external authentication source.

 *

 * @param string $authname

 *   The external authentication username.

 *

 * @return

 *   A fully-loaded user object if the user is found or FALSE if not found.

 */

function user_external_load($authname) {

  $uid = db_query("SELECT uid FROM {authmap} WHERE authname = :authname", array(':authname' => $authname))->fetchField();

  if ($uid) {

    return user_load($uid);

  }

  else {

    return FALSE;

  }

}

/**

 * Load multiple users based on certain conditions.

 *

 * This function should be used whenever you need to load more than one user

 * from the database. Users are loaded into memory and will not require

 * database access if loaded again during the same page request.

 *

 * @param $uids

 *   An array of user IDs.

 * @param $conditions

 *   (deprecated) An associative array of conditions on the {users}

 *   table, where the keys are the database fields and the values are the

 *   values those fields must have. Instead, it is preferable to use

 *   EntityFieldQuery to retrieve a list of entity IDs loadable by

 *   this function.

 * @param $reset

 *   A boolean indicating that the internal cache should be reset. Use this if

 *   loading a user object which has been altered during the page request.

 *

 * @return

 *   An array of user objects, indexed by uid.

 *

 * @see entity_load()

 * @see user_load()

 * @see user_load_by_mail()

 * @see user_load_by_name()

 * @see EntityFieldQuery

 *

 * @todo Remove $conditions in Drupal 8.

 */

function user_load_multiple($uids = array(), $conditions = array(), $reset = FALSE) {

  return entity_load('user', $uids, $conditions, $reset);

}

/**

 * Controller class for users.

 *

 * This extends the DrupalDefaultEntityController class, adding required

 * special handling for user objects.

 */

class UserController extends DrupalDefaultEntityController {

  function attachLoad(&$queried_users, $revision_id = FALSE) {

    // Build an array of user picture IDs so that these can be fetched later.

    $picture_fids = array();

    foreach ($queried_users as $key => $record) {

      $picture_fids[] = $record->picture;

      $queried_users[$key]->data = unserialize($record->data);

      $queried_users[$key]->roles = array();

      if ($record->uid) {

        $queried_users[$record->uid]->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';

      }

      else {

        $queried_users[$record->uid]->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';

      }

    }

    // Add any additional roles from the database.

    $result = db_query('SELECT r.rid, r.name, ur.uid FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid IN (:uids)', array(':uids' => array_keys($queried_users)));

    foreach ($result as $record) {

      $queried_users[$record->uid]->roles[$record->rid] = $record->name;

    }

    // Add the full file objects for user pictures if enabled.

    if (!empty($picture_fids) && variable_get('user_pictures', 0)) {

      $pictures = file_load_multiple($picture_fids);

      foreach ($queried_users as $account) {

        if (!empty($account->picture) && isset($pictures[$account->picture])) {

          $account->picture = $pictures[$account->picture];

        }

        else {

          $account->picture = NULL;

        }

      }

    }

    // Call the default attachLoad() method. This will add fields and call

    // hook_user_load().

    parent::attachLoad($queried_users, $revision_id);

  }

}

/**

 * Loads a user object.

 *

 * Drupal has a global $user object, which represents the currently-logged-in

 * user. So to avoid confusion and to avoid clobbering the global $user object,

 * it is a good idea to assign the result of this function to a different local

 * variable, generally $account. If you actually do want to act as the user you

 * are loading, it is essential to call drupal_save_session(FALSE); first.

 * See

 * @link http://drupal.org/node/218104 Safely impersonating another user @endlink

 * for more information.

 *

 * @param $uid

 *   Integer specifying the user ID to load.

 * @param $reset

 *   TRUE to reset the internal cache and load from the database; FALSE

 *   (default) to load from the internal cache, if set.

 *

 * @return

 *   A fully-loaded user object upon successful user load, or FALSE if the user

 *   cannot be loaded.

 *

 * @see user_load_multiple()

 */

function user_load($uid, $reset = FALSE) {

  $users = user_load_multiple(array($uid), array(), $reset);

  return reset($users);

}

/**

 * Fetch a user object by email address.

 *

 * @param $mail

 *   String with the account's e-mail address.

 * @return

 *   A fully-loaded $user object upon successful user load or FALSE if user

 *   cannot be loaded.

 *

 * @see user_load_multiple()

 */

function user_load_by_mail($mail) {

  $users = user_load_multiple(array(), array('mail' => $mail));

  return reset($users);

}

/**

 * Fetch a user object by account name.

 *

 * @param $name

 *   String with the account's user name.

 * @return

 *   A fully-loaded $user object upon successful user load or FALSE if user

 *   cannot be loaded.

 *

 * @see user_load_multiple()

 */

function user_load_by_name($name) {

  $users = user_load_multiple(array(), array('name' => $name));

  return reset($users);

}

/**

 * Save changes to a user account or add a new user.

 *

 * @param $account

 *   (optional) The user object to modify or add. If you want to modify

 *   an existing user account, you will need to ensure that (a) $account

 *   is an object, and (b) you have set $account->uid to the numeric

 *   user ID of the user account you wish to modify. If you

 *   want to create a new user account, you can set $account->is_new to

 *   TRUE or omit the $account->uid field.

 * @param $edit

 *   An array of fields and values to save. For example array('name'

 *   => 'My name'). Key / value pairs added to the $edit['data'] will be

 *   serialized and saved in the {users.data} column.

 * @param $category

 *   (optional) The category for storing profile information in.

 *

 * @return

 *   A fully-loaded $user object upon successful save or FALSE if the save failed.

 */

function user_save($account, $edit = array(), $category = 'account') {

  $transaction = db_transaction();

  try {

    if (isset($edit['pass']) && strlen(trim($edit['pass'])) > 0) {

      // Allow alternate password hashing schemes.

      require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

      $edit['pass'] = user_hash_password(trim($edit['pass']));

      // Abort if the hashing failed and returned FALSE.

      if (!$edit['pass']) {

        return FALSE;

      }

    }

    else {

      // Avoid overwriting an existing password with a blank password.

      unset($edit['pass']);

    }

    if (isset($edit['mail'])) {

      $edit['mail'] = trim($edit['mail']);

    }

    // Load the stored entity, if any.

    if (!empty($account->uid) && !isset($account->original)) {

      $account->original = entity_load_unchanged('user', $account->uid);

    }

    if (empty($account)) {

      $account = new stdClass();

    }

    if (!isset($account->is_new)) {

      $account->is_new = empty($account->uid);

    }

    // Prepopulate $edit['data'] with the current value of $account->data.

    // Modules can add to or remove from this array in hook_user_presave().

    if (!empty($account->data)) {

      $edit['data'] = !empty($edit['data']) ? array_merge($account->data, $edit['data']) : $account->data;

    }

    // Invoke hook_user_presave() for all modules.

    user_module_invoke('presave', $edit, $account, $category);

    // Invoke presave operations of Field Attach API and Entity API. Those APIs

    // require a fully-fledged and updated entity object. Therefore, we need to

    // copy any new property values of $edit into it.

    foreach ($edit as $key => $value) {

      $account->$key = $value;

    }

    field_attach_presave('user', $account);

    module_invoke_all('entity_presave', $account, 'user');

    if (is_object($account) && !$account->is_new) {

      // Process picture uploads.

      if (!empty($account->picture->fid) && (!isset($account->original->picture->fid) || $account->picture->fid != $account->original->picture->fid)) {

        $picture = $account->picture;

        // If the picture is a temporary file move it to its final location and

        // make it permanent.

        if (!$picture->status) {

          $info = image_get_info($picture->uri);

          $picture_directory =  file_default_scheme() . '://' . variable_get('user_picture_path', 'pictures');

          // Prepare the pictures directory.

          file_prepare_directory($picture_directory, FILE_CREATE_DIRECTORY);

          $destination = file_stream_wrapper_uri_normalize($picture_directory . '/picture-' . $account->uid . '-' . REQUEST_TIME . '.' . $info['extension']);

          // Move the temporary file into the final location.

          if ($picture = file_move($picture, $destination, FILE_EXISTS_RENAME)) {

            $picture->status = FILE_STATUS_PERMANENT;

            $account->picture = file_save($picture);

            file_usage_add($picture, 'user', 'user', $account->uid);

          }

        }

        // Delete the previous picture if it was deleted or replaced.

        if (!empty($account->original->picture->fid)) {

          file_usage_delete($account->original->picture, 'user', 'user', $account->uid);

          file_delete($account->original->picture);

        }

      }

      elseif (isset($edit['picture_delete']) && $edit['picture_delete']) {

        file_usage_delete($account->original->picture, 'user', 'user', $account->uid);

        file_delete($account->original->picture);

      }

      // Save the picture object, if it is set. drupal_write_record() expects

      // $account->picture to be a FID.

      $picture = empty($account->picture) ? NULL : $account->picture;

      $account->picture = empty($account->picture->fid) ? 0 : $account->picture->fid;

      // Do not allow 'uid' to be changed.

      $account->uid = $account->original->uid;

      // Save changes to the user table.

      $success = drupal_write_record('users', $account, 'uid');

      // Restore the picture object.

      $account->picture = $picture;

      if ($success === FALSE) {

        // The query failed - better to abort the save than risk further

        // data loss.

        return FALSE;

      }

      // Reload user roles if provided.

      if ($account->roles != $account->original->roles) {

        db_delete('users_roles')

          ->condition('uid', $account->uid)

          ->execute();

        $query = db_insert('users_roles')->fields(array('uid', 'rid'));

        foreach (array_keys($account->roles) as $rid) {

          if (!in_array($rid, array(DRUPAL_ANONYMOUS_RID, DRUPAL_AUTHENTICATED_RID))) {

            $query->values(array(

              'uid' => $account->uid,