<?php

/**

 * Core User API

 *

 * @package WordPress

 * @subpackage Users

 */

/**

 * Authenticates and logs a user in with 'remember' capability.

 *

 * The credentials is an array that has 'user_login', 'user_password', and

 * 'remember' indices. If the credentials is not given, then the log in form

 * will be assumed and used if set.

 *

 * The various authentication cookies will be set by this function and will be

 * set for a longer period depending on if the 'remember' credential is set to

 * true.

 *

 * Note: wp_signon() doesn't handle setting the current user. This means that if the

 * function is called before the {@see 'init'} hook is fired, is_user_logged_in() will

 * evaluate as false until that point. If is_user_logged_in() is needed in conjunction

 * with wp_signon(), wp_set_current_user() should be called explicitly.

 *

 * @since 2.5.0

 *

 * @global string $auth_secure_cookie

 *

 * @param array       $credentials   Optional. User info in order to sign on.

 * @param string|bool $secure_cookie Optional. Whether to use secure cookie.

 * @return WP_User|WP_Error WP_User on success, WP_Error on failure.

 */

function wp_signon( $credentials = array(), $secure_cookie = '' ) {

	if ( empty( $credentials ) ) {

		$credentials = array(); // Back-compat for plugins passing an empty string.

		if ( ! empty( $_POST['log'] ) ) {

			$credentials['user_login'] = wp_unslash( $_POST['log'] );

		}

		if ( ! empty( $_POST['pwd'] ) ) {

			$credentials['user_password'] = $_POST['pwd'];

		}

		if ( ! empty( $_POST['rememberme'] ) ) {

			$credentials['remember'] = $_POST['rememberme'];

		}

	}

	if ( ! empty( $credentials['remember'] ) ) {

		$credentials['remember'] = true;

	} else {

		$credentials['remember'] = false;

	}

	/**

	 * Fires before the user is authenticated.

	 *

	 * The variables passed to the callbacks are passed by reference,

	 * and can be modified by callback functions.

	 *

	 * @since 1.5.1

	 *

	 * @todo Decide whether to deprecate the wp_authenticate action.

	 *

	 * @param string $user_login    Username (passed by reference).

	 * @param string $user_password User password (passed by reference).

	 */

	do_action_ref_array( 'wp_authenticate', array( &$credentials['user_login'], &$credentials['user_password'] ) );

	if ( '' === $secure_cookie ) {

		$secure_cookie = is_ssl();

	}

	/**

	 * Filters whether to use a secure sign-on cookie.

	 *

	 * @since 3.1.0

	 *

	 * @param bool  $secure_cookie Whether to use a secure sign-on cookie.

	 * @param array $credentials {

	 *     Array of entered sign-on data.

	 *

	 *     @type string $user_login    Username.

	 *     @type string $user_password Password entered.

	 *     @type bool   $remember      Whether to 'remember' the user. Increases the time

	 *                                 that the cookie will be kept. Default false.

	 * }

	 */

	$secure_cookie = apply_filters( 'secure_signon_cookie', $secure_cookie, $credentials );

	global $auth_secure_cookie; // XXX ugly hack to pass this to wp_authenticate_cookie().

	$auth_secure_cookie = $secure_cookie;

	add_filter( 'authenticate', 'wp_authenticate_cookie', 30, 3 );

	$user = wp_authenticate( $credentials['user_login'], $credentials['user_password'] );

	if ( is_wp_error( $user ) ) {

		return $user;

	}

	wp_set_auth_cookie( $user->ID, $credentials['remember'], $secure_cookie );

	/**

	 * Fires after the user has successfully logged in.

	 *

	 * @since 1.5.0

	 *

	 * @param string  $user_login Username.

	 * @param WP_User $user       WP_User object of the logged-in user.

	 */

	do_action( 'wp_login', $user->user_login, $user );

	return $user;

}

/**

 * Authenticate a user, confirming the username and password are valid.

 *

 * @since 2.8.0

 *

 * @param WP_User|WP_Error|null $user     WP_User or WP_Error object from a previous callback. Default null.

 * @param string                $username Username for authentication.

 * @param string                $password Password for authentication.

 * @return WP_User|WP_Error WP_User on success, WP_Error on failure.

 */

function wp_authenticate_username_password( $user, $username, $password ) {

	if ( $user instanceof WP_User ) {

		return $user;

	}

	if ( empty( $username ) || empty( $password ) ) {

		if ( is_wp_error( $user ) ) {

			return $user;

		}

		$error = new WP_Error();

		if ( empty( $username ) ) {

			$error->add( 'empty_username', __( '<strong>Error</strong>: The username field is empty.' ) );

		}

		if ( empty( $password ) ) {

			$error->add( 'empty_password', __( '<strong>Error</strong>: The password field is empty.' ) );

		}

		return $error;

	}

	$user = get_user_by( 'login', $username );

	if ( ! $user ) {

		return new WP_Error(

			'invalid_username',

			__( 'Unknown username. Check again or try your email address.' )

		);

	}

	/**

	 * Filters whether the given user can be authenticated with the provided $password.

	 *

	 * @since 2.5.0

	 *

	 * @param WP_User|WP_Error $user     WP_User or WP_Error object if a previous

	 *                                   callback failed authentication.

	 * @param string           $password Password to check against the user.

	 */

	$user = apply_filters( 'wp_authenticate_user', $user, $password );

	if ( is_wp_error( $user ) ) {

		return $user;

	}

	if ( ! wp_check_password( $password, $user->user_pass, $user->ID ) ) {

		return new WP_Error(

			'incorrect_password',

			sprintf(

				/* translators: %s: User name. */

				__( '<strong>Error</strong>: The password you entered for the username %s is incorrect.' ),

				'<strong>' . $username . '</strong>'

			) .

			' <a href="' . wp_lostpassword_url() . '">' .

			__( 'Lost your password?' ) .

			'</a>'

		);

	}

	return $user;

}

/**

 * Authenticates a user using the email and password.

 *

 * @since 4.5.0

 *

 * @param WP_User|WP_Error|null $user     WP_User or WP_Error object if a previous

 *                                        callback failed authentication.

 * @param string                $email    Email address for authentication.

 * @param string                $password Password for authentication.

 * @return WP_User|WP_Error WP_User on success, WP_Error on failure.

 */

function wp_authenticate_email_password( $user, $email, $password ) {

	if ( $user instanceof WP_User ) {

		return $user;

	}

	if ( empty( $email ) || empty( $password ) ) {

		if ( is_wp_error( $user ) ) {

			return $user;

		}

		$error = new WP_Error();

		if ( empty( $email ) ) {

			// Uses 'empty_username' for back-compat with wp_signon().

			$error->add( 'empty_username', __( '<strong>Error</strong>: The email field is empty.' ) );

		}

		if ( empty( $password ) ) {

			$error->add( 'empty_password', __( '<strong>Error</strong>: The password field is empty.' ) );

		}

		return $error;

	}

	if ( ! is_email( $email ) ) {

		return $user;

	}

	$user = get_user_by( 'email', $email );

	if ( ! $user ) {

		return new WP_Error(

			'invalid_email',

			__( 'Unknown email address. Check again or try your username.' )

		);

	}

	/** This filter is documented in wp-includes/user.php */

	$user = apply_filters( 'wp_authenticate_user', $user, $password );

	if ( is_wp_error( $user ) ) {

		return $user;

	}

	if ( ! wp_check_password( $password, $user->user_pass, $user->ID ) ) {

		return new WP_Error(

			'incorrect_password',

			sprintf(

				/* translators: %s: Email address. */

				__( '<strong>Error</strong>: The password you entered for the email address %s is incorrect.' ),

				'<strong>' . $email . '</strong>'

			) .

			' <a href="' . wp_lostpassword_url() . '">' .

			__( 'Lost your password?' ) .

			'</a>'

		);

	}

	return $user;

}

/**

 * Authenticate the user using the WordPress auth cookie.

 *

 * @since 2.8.0

 *

 * @global string $auth_secure_cookie

 *

 * @param WP_User|WP_Error|null $user     WP_User or WP_Error object from a previous callback. Default null.

 * @param string                $username Username. If not empty, cancels the cookie authentication.

 * @param string                $password Password. If not empty, cancels the cookie authentication.

 * @return WP_User|WP_Error WP_User on success, WP_Error on failure.

 */

function wp_authenticate_cookie( $user, $username, $password ) {

	if ( $user instanceof WP_User ) {

		return $user;

	}

	if ( empty( $username ) && empty( $password ) ) {

		$user_id = wp_validate_auth_cookie();

		if ( $user_id ) {

			return new WP_User( $user_id );

		}

		global $auth_secure_cookie;

		if ( $auth_secure_cookie ) {

			$auth_cookie = SECURE_AUTH_COOKIE;

		} else {

			$auth_cookie = AUTH_COOKIE;

		}

		if ( ! empty( $_COOKIE[ $auth_cookie ] ) ) {

			return new WP_Error( 'expired_session', __( 'Please log in again.' ) );

		}

		// If the cookie is not set, be silent.

	}

	return $user;

}

/**

 * For Multisite blogs, check if the authenticated user has been marked as a

 * spammer, or if the user's primary blog has been marked as spam.

 *

 * @since 3.7.0

 *

 * @param WP_User|WP_Error|null $user WP_User or WP_Error object from a previous callback. Default null.

 * @return WP_User|WP_Error WP_User on success, WP_Error if the user is considered a spammer.

 */

function wp_authenticate_spam_check( $user ) {

	if ( $user instanceof WP_User && is_multisite() ) {

		/**

		 * Filters whether the user has been marked as a spammer.

		 *

		 * @since 3.7.0

		 *

		 * @param bool    $spammed Whether the user is considered a spammer.

		 * @param WP_User $user    User to check against.

		 */

		$spammed = apply_filters( 'check_is_user_spammed', is_user_spammy( $user ), $user );

		if ( $spammed ) {

			return new WP_Error( 'spammer_account', __( '<strong>Error</strong>: Your account has been marked as a spammer.' ) );

		}

	}

	return $user;

}

/**

 * Validates the logged-in cookie.

 *

 * Checks the logged-in cookie if the previous auth cookie could not be

 * validated and parsed.

 *

 * This is a callback for the {@see 'determine_current_user'} filter, rather than API.

 *

 * @since 3.9.0

 *

 * @param int|bool $user_id The user ID (or false) as received from

 *                          the `determine_current_user` filter.

 * @return int|false User ID if validated, false otherwise. If a user ID from

 *                   an earlier filter callback is received, that value is returned.

 */

function wp_validate_logged_in_cookie( $user_id ) {

	if ( $user_id ) {

		return $user_id;

	}

	if ( is_blog_admin() || is_network_admin() || empty( $_COOKIE[ LOGGED_IN_COOKIE ] ) ) {

		return false;

	}

	return wp_validate_auth_cookie( $_COOKIE[ LOGGED_IN_COOKIE ], 'logged_in' );

}

/**

 * Number of posts user has written.

 *

 * @since 3.0.0

 * @since 4.1.0 Added `$post_type` argument.

 * @since 4.3.0 Added `$public_only` argument. Added the ability to pass an array

 *              of post types to `$post_type`.

 *

 * @global wpdb $wpdb WordPress database abstraction object.

 *

 * @param int          $userid      User ID.

 * @param array|string $post_type   Optional. Single post type or array of post types to count the number of posts for. Default 'post'.

 * @param bool         $public_only Optional. Whether to only return counts for public posts. Default false.

 * @return string Number of posts the user has written in this post type.

 */

function count_user_posts( $userid, $post_type = 'post', $public_only = false ) {

	global $wpdb;

	$where = get_posts_by_author_sql( $post_type, true, $userid, $public_only );

	$count = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->posts $where" );

	/**

	 * Filters the number of posts a user has written.

	 *

	 * @since 2.7.0

	 * @since 4.1.0 Added `$post_type` argument.

	 * @since 4.3.1 Added `$public_only` argument.

	 *

	 * @param int          $count       The user's post count.

	 * @param int          $userid      User ID.

	 * @param string|array $post_type   Single post type or array of post types to count the number of posts for.

	 * @param bool         $public_only Whether to limit counted posts to public posts.

	 */

	return apply_filters( 'get_usernumposts', $count, $userid, $post_type, $public_only );

}

/**

 * Number of posts written by a list of users.

 *

 * @since 3.0.0

 *

 * @global wpdb $wpdb WordPress database abstraction object.

 *

 * @param int[]           $users       Array of user IDs.

 * @param string|string[] $post_type   Optional. Single post type or array of post types to check. Defaults to 'post'.

 * @param bool            $public_only Optional. Only return counts for public posts.  Defaults to false.

 * @return string[] Amount of posts each user has written, as strings, keyed by user ID.

 */

function count_many_users_posts( $users, $post_type = 'post', $public_only = false ) {

	global $wpdb;

	$count = array();

	if ( empty( $users ) || ! is_array( $users ) ) {

		return $count;

	}

	$userlist = implode( ',', array_map( 'absint', $users ) );

	$where    = get_posts_by_author_sql( $post_type, true, null, $public_only );

	$result = $wpdb->get_results( "SELECT post_author, COUNT(*) FROM $wpdb->posts $where AND post_author IN ($userlist) GROUP BY post_author", ARRAY_N );

	foreach ( $result as $row ) {

		$count[ $row[0] ] = $row[1];

	}

	foreach ( $users as $id ) {

		if ( ! isset( $count[ $id ] ) ) {

			$count[ $id ] = 0;

		}

	}

	return $count;

}

//

// User option functions.

//

/**

 * Get the current user's ID

 *

 * @since MU (3.0.0)

 *

 * @return int The current user's ID, or 0 if no user is logged in.

 */

function get_current_user_id() {

	if ( ! function_exists( 'wp_get_current_user' ) ) {

		return 0;

	}

	$user = wp_get_current_user();

	return ( isset( $user->ID ) ? (int) $user->ID : 0 );

}

/**

 * Retrieve user option that can be either per Site or per Network.

 *

 * If the user ID is not given, then the current user will be used instead. If

 * the user ID is given, then the user data will be retrieved. The filter for

 * the result, will also pass the original option name and finally the user data

 * object as the third parameter.

 *

 * The option will first check for the per site name and then the per Network name.

 *

 * @since 2.0.0

 *

 * @global wpdb $wpdb WordPress database abstraction object.

 *

 * @param string $option     User option name.

 * @param int    $user       Optional. User ID.

 * @param string $deprecated Use get_option() to check for an option in the options table.

 * @return mixed User option value on success, false on failure.

 */

function get_user_option( $option, $user = 0, $deprecated = '' ) {

	global $wpdb;

	if ( ! empty( $deprecated ) ) {

		_deprecated_argument( __FUNCTION__, '3.0.0' );

	}

	if ( empty( $user ) ) {

		$user = get_current_user_id();

	}

	$user = get_userdata( $user );

	if ( ! $user ) {

		return false;

	}

	$prefix = $wpdb->get_blog_prefix();

	if ( $user->has_prop( $prefix . $option ) ) { // Blog-specific.

		$result = $user->get( $prefix . $option );

	} elseif ( $user->has_prop( $option ) ) { // User-specific and cross-blog.

		$result = $user->get( $option );

	} else {

		$result = false;

	}

	/**

	 * Filters a specific user option value.