<?php

/**

 *

 * @package WordPress

 * @subpackage Users

 */

/**

 *

 * The credentials is an array that has 'user_login', 'user_password', and

 * 'remember' indices. If the credentials is not given, then the log in form

 * will be assumed and used if set.

 *

 * The various authentication cookies will be set by this function and will be

 * set for a longer period depending on if the 'remember' credential is set to

 * true.

 *

 * @since 2.5.0

 *

 * @param array       $credentials   Optional. User info in order to sign on.

 * @param string|bool $secure_cookie Optional. Whether to use secure cookie.

 * @return WP_User|WP_Error WP_User on success, WP_Error on failure.

 */

function wp_signon( $credentials = array(), $secure_cookie = '' ) {

	if ( empty($credentials) ) {

		if ( ! empty($_POST['log']) )

			$credentials['user_login'] = $_POST['log'];

		if ( ! empty($_POST['pwd']) )

			$credentials['user_password'] = $_POST['pwd'];

		if ( ! empty($_POST['rememberme']) )

			$credentials['remember'] = $_POST['rememberme'];

	}

	if ( !empty($credentials['remember']) )

		$credentials['remember'] = true;

	else

		$credentials['remember'] = false;

	/**

	 * Fires before the user is authenticated.

	 *

	 * The variables passed to the callbacks are passed by reference,

	 * and can be modified by callback functions.

	 *

	 * @since 1.5.1

	 *

	 * @todo Decide whether to deprecate the wp_authenticate action.

	 *

	 */

	do_action_ref_array( 'wp_authenticate', array( &$credentials['user_login'], &$credentials['user_password'] ) );

	if ( '' === $secure_cookie )

		$secure_cookie = is_ssl();

	/**

	 *

	 * @since 3.1.0

	 *

	 * @param bool  $secure_cookie Whether to use a secure sign-on cookie.

	 * @param array $credentials {

 	 *     Array of entered sign-on data.

 	 *

 	 *     @type string $user_login    Username.

 	 *     @type string $user_password Password entered.

	 *     @type bool   $remember      Whether to 'remember' the user. Increases the time

	 *                                 that the cookie will be kept. Default false.

 	 * }

	 */

	$secure_cookie = apply_filters( 'secure_signon_cookie', $secure_cookie, $credentials );

	global $auth_secure_cookie; // XXX ugly hack to pass this to wp_authenticate_cookie

	$auth_secure_cookie = $secure_cookie;

	add_filter('authenticate', 'wp_authenticate_cookie', 30, 3);

	$user = wp_authenticate($credentials['user_login'], $credentials['user_password']);

	if ( is_wp_error($user) ) {

		if ( $user->get_error_codes() == array('empty_username', 'empty_password') ) {

			$user = new WP_Error('', '');

		}

		return $user;

	}

	wp_set_auth_cookie($user->ID, $credentials['remember'], $secure_cookie);

	/**

	 * Fires after the user has successfully logged in.

	 *

	 * @since 1.5.0

	 *

	 * @param string  $user_login Username.

	 * @param WP_User $user       WP_User object of the logged-in user.

	 */

	do_action( 'wp_login', $user->user_login, $user );

	return $user;

}

/**

 *

 * @since 2.8.0

 *

 * @param WP_User|WP_Error|null $user     WP_User or WP_Error object from a previous callback. Default null.

 * @param string                $username Username for authentication.

 * @param string                $password Password for authentication.

 * @return WP_User|WP_Error WP_User on success, WP_Error on failure.

 */

function wp_authenticate_username_password($user, $username, $password) {

	if ( $user instanceof WP_User ) {

		return $user;

	}

	if ( empty($username) || empty($password) ) {

		if ( is_wp_error( $user ) )

			return $user;

		$error = new WP_Error();

		if ( empty($username) )

			$error->add('empty_username', __('<strong>ERROR</strong>: The username field is empty.'));

		if ( empty($password) )

			$error->add('empty_password', __('<strong>ERROR</strong>: The password field is empty.'));

		return $error;

	}

	$user = get_user_by('login', $username);

	/**

	 *

	 * @since 2.5.0

	 *

	 * @param WP_User|WP_Error $user     WP_User or WP_Error object if a previous

	 *                                   callback failed authentication.

	 * @param string           $password Password to check against the user.

	 */

	$user = apply_filters( 'wp_authenticate_user', $user, $password );

	if ( is_wp_error($user) )

		return $user;

	return $user;

}

/**

 * Authenticate the user using the WordPress auth cookie.

 *

 * @since 2.8.0

 *

 * @param WP_User|WP_Error|null $user     WP_User or WP_Error object from a previous callback. Default null.

 * @param string                $username Username. If not empty, cancels the cookie authentication.

 * @param string                $password Password. If not empty, cancels the cookie authentication.

 * @return WP_User|WP_Error WP_User on success, WP_Error on failure.

 */

function wp_authenticate_cookie($user, $username, $password) {

	if ( $user instanceof WP_User ) {

		return $user;

	}

	if ( empty($username) && empty($password) ) {

		$user_id = wp_validate_auth_cookie();

		if ( $user_id )

			return new WP_User($user_id);

		global $auth_secure_cookie;

		if ( $auth_secure_cookie )

			$auth_cookie = SECURE_AUTH_COOKIE;

		else

			$auth_cookie = AUTH_COOKIE;

		if ( !empty($_COOKIE[$auth_cookie]) )

			return new WP_Error('expired_session', __('Please log in again.'));

		// If the cookie is not set, be silent.

	}

	return $user;

}

/**

 * For Multisite blogs, check if the authenticated user has been marked as a

 * spammer, or if the user's primary blog has been marked as spam.

 *

 * @since 3.7.0

 *

 * @param WP_User|WP_Error|null $user WP_User or WP_Error object from a previous callback. Default null.

 * @return WP_User|WP_Error WP_User on success, WP_Error if the user is considered a spammer.

 */

function wp_authenticate_spam_check( $user ) {

	if ( $user instanceof WP_User && is_multisite() ) {

		/**

		 *

		 * @since 3.7.0

		 *

		 * @param bool    $spammed Whether the user is considered a spammer.

		 * @param WP_User $user    User to check against.

		 */

		if ( $spammed )

			return new WP_Error( 'spammer_account', __( '<strong>ERROR</strong>: Your account has been marked as a spammer.' ) );

	}

	return $user;

}

/**

 *

 * Checks the logged-in cookie if the previous auth cookie could not be

 * validated and parsed.

 *

 *

 * @since 3.9.0

 *

 * @param int|bool $user_id The user ID (or false) as received from the

 *                       determine_current_user filter.

 */

function wp_validate_logged_in_cookie( $user_id ) {

	if ( $user_id ) {

		return $user_id;

	}

	if ( is_blog_admin() || is_network_admin() || empty( $_COOKIE[LOGGED_IN_COOKIE] ) ) {

		return false;

	}

	return wp_validate_auth_cookie( $_COOKIE[LOGGED_IN_COOKIE], 'logged_in' );

}

/**

 * Number of posts user has written.

 *

 * @since 3.0.0

 * @since 4.1.0 Added `$post_type` argument.

 *

 *

 */

	global $wpdb;

	$count = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->posts $where" );

	/**

	 *

	 * @since 2.7.0

	 * @since 4.1.0 Added `$post_type` argument.

	 *

	 */

}

/**

 * Number of posts written by a list of users.

 *

 * @since 3.0.0

 *

 * @return array Amount of posts each user has written.

 */

function count_many_users_posts( $users, $post_type = 'post', $public_only = false ) {

	global $wpdb;

	$count = array();

	if ( empty( $users ) || ! is_array( $users ) )

		return $count;

	$userlist = implode( ',', array_map( 'absint', $users ) );

	$where = get_posts_by_author_sql( $post_type, true, null, $public_only );

	$result = $wpdb->get_results( "SELECT post_author, COUNT(*) FROM $wpdb->posts $where AND post_author IN ($userlist) GROUP BY post_author", ARRAY_N );

	foreach ( $result as $row ) {

		$count[ $row[0] ] = $row[1];

	}

	foreach ( $users as $id ) {

		if ( ! isset( $count[ $id ] ) )

			$count[ $id ] = 0;

	}

	return $count;

}

//

// User option functions

//

/**

 * Get the current user's ID

 *

 *

 */

function get_current_user_id() {

	if ( ! function_exists( 'wp_get_current_user' ) )

		return 0;

	$user = wp_get_current_user();

	return ( isset( $user->ID ) ? (int) $user->ID : 0 );

}

/**

 * Retrieve user option that can be either per Site or per Network.

 *

 * If the user ID is not given, then the current user will be used instead. If

 * the user ID is given, then the user data will be retrieved. The filter for

 * the result, will also pass the original option name and finally the user data

 * object as the third parameter.

 *

 * The option will first check for the per site name and then the per Network name.

 *

 * @since 2.0.0

 *

 *

 * @param string $option     User option name.

 * @param int    $user       Optional. User ID.

 * @param string $deprecated Use get_option() to check for an option in the options table.

 * @return mixed User option value on success, false on failure.

 */

function get_user_option( $option, $user = 0, $deprecated = '' ) {

	global $wpdb;

	if ( !empty( $deprecated ) )

	if ( empty( $user ) )

		$user = get_current_user_id();

	if ( ! $user = get_userdata( $user ) )

		return false;

	$prefix = $wpdb->get_blog_prefix();

	if ( $user->has_prop( $prefix . $option ) ) // Blog specific

		$result = $user->get( $prefix . $option );

	elseif ( $user->has_prop( $option ) ) // User specific and cross-blog

		$result = $user->get( $option );

	else

		$result = false;

	/**

	 *

	 * The dynamic portion of the hook name, `$option`, refers to the user option name.

	 *

	 * @since 2.5.0

	 *

	 * @param mixed   $result Value for the user's option.

	 * @param string  $option Name of the option being retrieved.

	 * @param WP_User $user   WP_User object of the user whose option is being retrieved.

	 */

	return apply_filters( "get_user_option_{$option}", $result, $option, $user );

}

/**

 * Update user option with global blog capability.

 *

 * User options are just like user metadata except that they have support for

 * global blog options. If the 'global' parameter is false, which it is by default

 * it will prepend the WordPress table prefix to the option name.

 *

 * Deletes the user option if $newvalue is empty.

 *

 * @since 2.0.0

 *

 *

 * @param int    $user_id     User ID.

 * @param string $option_name User option name.