<?php

// $Id: user.module,v 1.892.2.14 2009/07/01 20:51:56 goba Exp $

/**

 * @file

 * Enables the user registration and login system.

 */

define('USERNAME_MAX_LENGTH', 60);

define('EMAIL_MAX_LENGTH', 64);

/**

 * Invokes hook_user() in every module.

 *

 * We cannot use module_invoke() for this, because the arguments need to

 * be passed by reference.

 */

function user_module_invoke($type, &$array, &$user, $category = NULL) {

  foreach (module_list() as $module) {

    $function = $module .'_user';

    if (function_exists($function)) {

      $function($type, $array, $user, $category);

    }

  }

}

/**

 * Implementation of hook_theme().

 */

function user_theme() {

  return array(

    'user_picture' => array(

      'arguments' => array('account' => NULL),

      'template' => 'user-picture',

    ),

    'user_profile' => array(

      'arguments' => array('account' => NULL),

      'template' => 'user-profile',

      'file' => 'user.pages.inc',

    ),

    'user_profile_category' => array(

      'arguments' => array('element' => NULL),

      'template' => 'user-profile-category',

      'file' => 'user.pages.inc',

    ),

    'user_profile_item' => array(

      'arguments' => array('element' => NULL),

      'template' => 'user-profile-item',

      'file' => 'user.pages.inc',

    ),

    'user_list' => array(

      'arguments' => array('users' => NULL, 'title' => NULL),

    ),

    'user_admin_perm' => array(

      'arguments' => array('form' => NULL),

      'file' => 'user.admin.inc',

    ),

    'user_admin_new_role' => array(

      'arguments' => array('form' => NULL),

      'file' => 'user.admin.inc',

    ),

    'user_admin_account' => array(

      'arguments' => array('form' => NULL),

      'file' => 'user.admin.inc',

    ),

    'user_filter_form' => array(

      'arguments' => array('form' => NULL),

      'file' => 'user.admin.inc',

    ),

    'user_filters' => array(

      'arguments' => array('form' => NULL),

      'file' => 'user.admin.inc',

    ),

    'user_signature' => array(

      'arguments' => array('signature' => NULL),

    ),

  );

}

function user_external_load($authname) {

  $result = db_query("SELECT uid FROM {authmap} WHERE authname = '%s'", $authname);

  if ($user = db_fetch_array($result)) {

    return user_load($user);

  }

  else {

    return 0;

  }

}

/**

 * Perform standard Drupal login operations for a user object.

 *

 * The user object must already be authenticated. This function verifies

 * that the user account is not blocked/denied and then performs the login,

 * updates the login timestamp in the database, invokes hook_user('login'),

 * and regenerates the session.

 *

 * @param $account

 *    An authenticated user object to be set as the currently logged

 *    in user.

 * @param $edit

 *    The array of form values submitted by the user, if any.

 *    This array is passed to hook_user op login.

 * @return boolean

 *    TRUE if the login succeeds, FALSE otherwise.

 */

function user_external_login($account, $edit = array()) {

  $form = drupal_get_form('user_login');

  $state['values'] = $edit;

  if (empty($state['values']['name'])) {

    $state['values']['name'] = $account->name;

  }

  // Check if user is blocked or denied by access rules.

  user_login_name_validate($form, $state, (array)$account);

  if (form_get_errors()) {

    // Invalid login.

    return FALSE;

  }

  // Valid login.

  global $user;

  $user = $account;

  user_authenticate_finalize($state['values']);

  return TRUE;

}

/**

 * Fetch a user object.

 *

 * @param $array

 *   An associative array of attributes to search for in selecting the

 *   user, such as user name or e-mail address.

 *

 * @return

 *   A fully-loaded $user object upon successful user load or FALSE if user

 *   cannot be loaded.

 */

function user_load($array = array()) {

  // Dynamically compose a SQL query:

  $query = array();

  $params = array();

  if (is_numeric($array)) {

    $array = array('uid' => $array);

  }

  elseif (!is_array($array)) {

    return FALSE;

  }

  foreach ($array as $key => $value) {

    if ($key == 'uid' || $key == 'status') {

      $query[] = "$key = %d";

      $params[] = $value;

    }

    else if ($key == 'pass') {

      $query[] = "pass = '%s'";

      $params[] = md5($value);

    }

    else {

      $query[]= "LOWER($key) = LOWER('%s')";

      $params[] = $value;

    }

  }

  $result = db_query('SELECT * FROM {users} u WHERE '. implode(' AND ', $query), $params);

  if ($user = db_fetch_object($result)) {

    $user = drupal_unpack($user);

    $user->roles = array();

    if ($user->uid) {

      $user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';

    }

    else {

      $user->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';

    }

    $result = db_query('SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $user->uid);

    while ($role = db_fetch_object($result)) {

      $user->roles[$role->rid] = $role->name;

    }

    user_module_invoke('load', $array, $user);

  }

  else {

    $user = FALSE;

  }

  return $user;

}

/**

 * Save changes to a user account or add a new user.

 *

 * @param $account

 *   The $user object for the user to modify or add. If $user->uid is

 *   omitted, a new user will be added.

 *

 * @param $array

 *   (optional) An array of fields and values to save. For example,

 *   array('name' => 'My name'); Setting a field to NULL deletes it from

 *   the data column.

 *

 * @param $category

 *   (optional) The category for storing profile information in.

 *

 * @return

 *   A fully-loaded $user object upon successful save or FALSE if the save failed.

 */

function user_save($account, $array = array(), $category = 'account') {

  // Dynamically compose a SQL query:

  $user_fields = user_fields();

  if (is_object($account) && $account->uid) {

    user_module_invoke('update', $array, $account, $category);

    $query = '';

    $data = unserialize(db_result(db_query('SELECT data FROM {users} WHERE uid = %d', $account->uid)));

    // Consider users edited by an administrator as logged in, if they haven't

    // already, so anonymous users can view the profile (if allowed).

    if (empty($array['access']) && empty($account->access) && user_access('administer users')) {

      $array['access'] = time();

    }

    foreach ($array as $key => $value) {

      if ($key == 'pass' && !empty($value)) {

        $query .= "$key = '%s', ";

        $v[] = md5($value);

      }

      else if ((substr($key, 0, 4) !== 'auth') && ($key != 'pass')) {

        if (in_array($key, $user_fields)) {

          // Save standard fields.

          $query .= "$key = '%s', ";

          $v[] = $value;

        }

        else if ($key != 'roles') {

          // Roles is a special case: it used below.

          if ($value === NULL) {

            unset($data[$key]);

          }

          else {

            $data[$key] = $value;

          }

        }

      }

    }

    $query .= "data = '%s' ";

    $v[] = serialize($data);

    $success = db_query("UPDATE {users} SET $query WHERE uid = %d", array_merge($v, array($account->uid)));

    if (!$success) {

      // The query failed - better to abort the save than risk further data loss.

      return FALSE;

    }

    // Reload user roles if provided.

    if (isset($array['roles']) && is_array($array['roles'])) {

      db_query('DELETE FROM {users_roles} WHERE uid = %d', $account->uid);

      foreach (array_keys($array['roles']) as $rid) {

        if (!in_array($rid, array(DRUPAL_ANONYMOUS_RID, DRUPAL_AUTHENTICATED_RID))) {

          db_query('INSERT INTO {users_roles} (uid, rid) VALUES (%d, %d)', $account->uid, $rid);

        }

      }

    }

    // Delete a blocked user's sessions to kick them if they are online.

    if (isset($array['status']) && $array['status'] == 0) {

      sess_destroy_uid($account->uid);

    }

    // If the password changed, delete all open sessions and recreate

    // the current one.

    if (!empty($array['pass'])) {

      sess_destroy_uid($account->uid);

      if ($account->uid == $GLOBALS['user']->uid) {

        sess_regenerate();

      }

    }

    // Refresh user object.

    $user = user_load(array('uid' => $account->uid));

    // Send emails after we have the new user object.

    if (isset($array['status']) && $array['status'] != $account->status) {

      // The user's status is changing; conditionally send notification email.

      $op = $array['status'] == 1 ? 'status_activated' : 'status_blocked';

      _user_mail_notify($op, $user);

    }

    user_module_invoke('after_update', $array, $user, $category);

  }

  else {

    // Allow 'created' to be set by the caller.

    if (!isset($array['created'])) {

      $array['created'] = time();

    }

    // Consider users created by an administrator as already logged in, so

    // anonymous users can view the profile (if allowed).

    if (empty($array['access']) && user_access('administer users')) {

      $array['access'] = time();

    }

    // Note: we wait to save the data column to prevent module-handled

    // fields from being saved there. We cannot invoke hook_user('insert') here

    // because we don't have a fully initialized user object yet.

    foreach ($array as $key => $value) {

      switch ($key) {

        case 'pass':

          $fields[] = $key;

          $values[] = md5($value);

          $s[] = "'%s'";

          break;

        case 'mode':       case 'sort':     case 'timezone':

        case 'threshold':  case 'created':  case 'access':

        case 'login':      case 'status':

          $fields[] = $key;

          $values[] = $value;

          $s[] = "%d";

          break;

        default:

          if (substr($key, 0, 4) !== 'auth' && in_array($key, $user_fields)) {

            $fields[] = $key;

            $values[] = $value;

            $s[] = "'%s'";

          }

          break;

      }

    }

    $success = db_query('INSERT INTO {users} ('. implode(', ', $fields) .') VALUES ('. implode(', ', $s) .')', $values);

    if (!$success) {

      // On a failed INSERT some other existing user's uid may be returned.

      // We must abort to avoid overwriting their account.

      return FALSE;

    }

    // Build the initial user object.

    $array['uid'] = db_last_insert_id('users', 'uid');

    $user = user_load(array('uid' => $array['uid']));

    user_module_invoke('insert', $array, $user, $category);

    // Build and save the serialized data field now.

    $data = array();

    foreach ($array as $key => $value) {

      if ((substr($key, 0, 4) !== 'auth') && ($key != 'roles') && (!in_array($key, $user_fields)) && ($value !== NULL)) {

        $data[$key] = $value;

      }

    }

    db_query("UPDATE {users} SET data = '%s' WHERE uid = %d", serialize($data), $user->uid);

    // Save user roles (delete just to be safe).

    if (isset($array['roles']) && is_array($array['roles'])) {

      db_query('DELETE FROM {users_roles} WHERE uid = %d', $array['uid']);

      foreach (array_keys($array['roles']) as $rid) {

        if (!in_array($rid, array(DRUPAL_ANONYMOUS_RID, DRUPAL_AUTHENTICATED_RID))) {

          db_query('INSERT INTO {users_roles} (uid, rid) VALUES (%d, %d)', $array['uid'], $rid);

        }

      }

    }

    // Build the finished user object.

    $user = user_load(array('uid' => $array['uid']));

  }

  // Save distributed authentication mappings.

  $authmaps = array();

  foreach ($array as $key => $value) {

    if (substr($key, 0, 4) == 'auth') {

      $authmaps[$key] = $value;

    }

  }

  if (sizeof($authmaps) > 0) {

    user_set_authmaps($user, $authmaps);

  }

  return $user;

}

/**

 * Verify the syntax of the given name.

 */

function user_validate_name($name) {

  if (!strlen($name)) return t('You must enter a username.');

  if (substr($name, 0, 1) == ' ') return t('The username cannot begin with a space.');

  if (substr($name, -1) == ' ') return t('The username cannot end with a space.');

  if (strpos($name, '  ') !== FALSE) return t('The username cannot contain multiple spaces in a row.');

  if (ereg("[^\x80-\xF7 [:alnum:]@_.-]", $name)) return t('The username contains an illegal character.');

  if (preg_match('/[\x{80}-\x{A0}'.          // Non-printable ISO-8859-1 + NBSP

                   '\x{AD}'.                 // Soft-hyphen

                   '\x{2000}-\x{200F}'.      // Various space characters

                   '\x{2028}-\x{202F}'.      // Bidirectional text overrides

                   '\x{205F}-\x{206F}'.      // Various text hinting characters

                   '\x{FEFF}'.               // Byte order mark

                   '\x{FF01}-\x{FF60}'.      // Full-width latin

                   '\x{FFF9}-\x{FFFD}'.      // Replacement characters

                   '\x{0}]/u',               // NULL byte

                   $name)) {

    return t('The username contains an illegal character.');

  }

  if (strpos($name, '@') !== FALSE && !eregi('@([0-9a-z](-?[0-9a-z])*.)+[a-z]{2}([zmuvtg]|fo|me)?$', $name)) return t('The username is not a valid authentication ID.');

  if (strlen($name) > USERNAME_MAX_LENGTH) return t('The username %name is too long: it must be %max characters or less.', array('%name' => $name, '%max' => USERNAME_MAX_LENGTH));

}

function user_validate_mail($mail) {

  if (!$mail) return t('You must enter an e-mail address.');

  if (!valid_email_address($mail)) {

    return t('The e-mail address %mail is not valid.', array('%mail' => $mail));

  }

}

function user_validate_picture(&$form, &$form_state) {

  // If required, validate the uploaded picture.

  $validators = array(

    'file_validate_is_image' => array(),

    'file_validate_image_resolution' => array(variable_get('user_picture_dimensions', '85x85')),

    'file_validate_size' => array(variable_get('user_picture_file_size', '30') * 1024),

  );

  if ($file = file_save_upload('picture_upload', $validators)) {

    // Remove the old picture.

    if (isset($form_state['values']['_account']->picture) && file_exists($form_state['values']['_account']->picture)) {

      file_delete($form_state['values']['_account']->picture);

    }

    // The image was saved using file_save_upload() and was added to the

    // files table as a temporary file. We'll make a copy and let the garbage

    // collector delete the original upload.

    $info = image_get_info($file->filepath);

    $destination = variable_get('user_picture_path', 'pictures') .'/picture-'. $form['#uid'] .'.'. $info['extension'];

    if (file_copy($file, $destination, FILE_EXISTS_REPLACE)) {

      $form_state['values']['picture'] = $file->filepath;

    }

    else {

      form_set_error('picture_upload', t("Failed to upload the picture image; the %directory directory doesn't exist or is not writable.", array('%directory' => variable_get('user_picture_path', 'pictures'))));

    }

  }

}

/**

 * Generate a random alphanumeric password.

 */

function user_password($length = 10) {

  // This variable contains the list of allowable characters for the

  // password. Note that the number 0 and the letter 'O' have been

  // removed to avoid confusion between the two. The same is true

  // of 'I', 1, and 'l'.

  $allowable_characters = 'abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';

  // Zero-based count of characters in the allowable list:

  $len = strlen($allowable_characters) - 1;

  // Declare the password as a blank string.

  $pass = '';

  // Loop the number of times specified by $length.

  for ($i = 0; $i < $length; $i++) {

    // Each iteration, pick a random character from the

    // allowable string and append it to the password:

    $pass .= $allowable_characters[mt_rand(0, $len)];

  }

  return $pass;

}

/**

 * Determine whether the user has a given privilege.

 *

 * @param $string

 *   The permission, such as "administer nodes", being checked for.

 * @param $account

 *   (optional) The account to check, if not given use currently logged in user.

 * @param $reset

 *   (optional) Resets the user's permissions cache, which will result in a

 *   recalculation of the user's permissions. This is necessary to support

 *   dynamically added user roles.

 *

 * @return

 *   Boolean TRUE if the current user has the requested permission.

 *

 * All permission checks in Drupal should go through this function. This

 * way, we guarantee consistent behavior, and ensure that the superuser

 * can perform all actions.

 */

function user_access($string, $account = NULL, $reset = FALSE) {

  global $user;

  static $perm = array();

  if ($reset) {

    $perm = array();

  }

  if (is_null($account)) {

    $account = $user;

  }

  // User #1 has all privileges:

  if ($account->uid == 1) {

    return TRUE;

  }

  // To reduce the number of SQL queries, we cache the user's permissions

  // in a static variable.

  if (!isset($perm[$account->uid])) {

    $result = db_query("SELECT p.perm FROM {role} r INNER JOIN {permission} p ON p.rid = r.rid WHERE r.rid IN (". db_placeholders($account->roles) .")", array_keys($account->roles));

    $perms = array();

    while ($row = db_fetch_object($result)) {

      $perms += array_flip(explode(', ', $row->perm));

    }

    $perm[$account->uid] = $perms;

  }

  return isset($perm[$account->uid][$string]);

}

/**

 * Checks for usernames blocked by user administration.

 *

 * @return boolean TRUE for blocked users, FALSE for active.

 */

function user_is_blocked($name) {

  $deny = db_fetch_object(db_query("SELECT name FROM {users} WHERE status = 0 AND name = LOWER('%s')", $name));

  return $deny;

}

function user_fields() {

  static $fields;

  if (!$fields) {

    $result = db_query('SELECT * FROM {users} WHERE uid = 1');