<?php

/**

 * WordPress User API

 *

 * @package WordPress

 */

/**

 * Authenticate user with remember capability.

 *

 * The credentials is an array that has 'user_login', 'user_password', and

 * 'remember' indices. If the credentials is not given, then the log in form

 * will be assumed and used if set.

 *

 * The various authentication cookies will be set by this function and will be

 * set for a longer period depending on if the 'remember' credential is set to

 * true.

 *

 * @since 2.5.0

 *

 * @param array $credentials Optional. User info in order to sign on.

 * @param bool $secure_cookie Optional. Whether to use secure cookie.

 * @return object Either WP_Error on failure, or WP_User on success.

 */

function wp_signon( $credentials = '', $secure_cookie = '' ) {

	if ( empty($credentials) ) {

		if ( ! empty($_POST['log']) )

			$credentials['user_login'] = $_POST['log'];

		if ( ! empty($_POST['pwd']) )

			$credentials['user_password'] = $_POST['pwd'];

		if ( ! empty($_POST['rememberme']) )

			$credentials['remember'] = $_POST['rememberme'];

	}

	if ( !empty($credentials['remember']) )

		$credentials['remember'] = true;

	else

		$credentials['remember'] = false;

	// TODO do we deprecate the wp_authentication action?

	do_action_ref_array('wp_authenticate', array(&$credentials['user_login'], &$credentials['user_password']));

	if ( '' === $secure_cookie )

		$secure_cookie = is_ssl();

	$secure_cookie = apply_filters('secure_signon_cookie', $secure_cookie, $credentials);

	global $auth_secure_cookie; // XXX ugly hack to pass this to wp_authenticate_cookie

	$auth_secure_cookie = $secure_cookie;

	add_filter('authenticate', 'wp_authenticate_cookie', 30, 3);

	$user = wp_authenticate($credentials['user_login'], $credentials['user_password']);

	if ( is_wp_error($user) ) {

		if ( $user->get_error_codes() == array('empty_username', 'empty_password') ) {

			$user = new WP_Error('', '');

		}

		return $user;

	}

	wp_set_auth_cookie($user->ID, $credentials['remember'], $secure_cookie);

	do_action('wp_login', $user->user_login, $user);

	return $user;

}

/**

 * Authenticate the user using the username and password.

 */

add_filter('authenticate', 'wp_authenticate_username_password', 20, 3);

function wp_authenticate_username_password($user, $username, $password) {

	if ( is_a($user, 'WP_User') ) { return $user; }

	if ( empty($username) || empty($password) ) {

		$error = new WP_Error();

		if ( empty($username) )

			$error->add('empty_username', __('<strong>ERROR</strong>: The username field is empty.'));

		if ( empty($password) )

			$error->add('empty_password', __('<strong>ERROR</strong>: The password field is empty.'));

		return $error;

	}

	$userdata = get_user_by('login', $username);

	if ( !$userdata )

		return new WP_Error('invalid_username', sprintf(__('<strong>ERROR</strong>: Invalid username. <a href="%s" title="Password Lost and Found">Lost your password</a>?'), wp_lostpassword_url()));

	if ( is_multisite() ) {

		// Is user marked as spam?

		if ( 1 == $userdata->spam)

			return new WP_Error('invalid_username', __('<strong>ERROR</strong>: Your account has been marked as a spammer.'));

		// Is a user's blog marked as spam?

		if ( !is_super_admin( $userdata->ID ) && isset($userdata->primary_blog) ) {

			$details = get_blog_details( $userdata->primary_blog );

			if ( is_object( $details ) && $details->spam == 1 )

				return new WP_Error('blog_suspended', __('Site Suspended.'));

		}

	}

	$userdata = apply_filters('wp_authenticate_user', $userdata, $password);

	if ( is_wp_error($userdata) )

		return $userdata;

	if ( !wp_check_password($password, $userdata->user_pass, $userdata->ID) )

		return new WP_Error( 'incorrect_password', sprintf( __( '<strong>ERROR</strong>: The password you entered for the username <strong>%1$s</strong> is incorrect. <a href="%2$s" title="Password Lost and Found">Lost your password</a>?' ),

		$username, wp_lostpassword_url() ) );

	$user =  new WP_User($userdata->ID);

	return $user;

}

/**

 * Authenticate the user using the WordPress auth cookie.

 */

function wp_authenticate_cookie($user, $username, $password) {

	if ( is_a($user, 'WP_User') ) { return $user; }

	if ( empty($username) && empty($password) ) {

		$user_id = wp_validate_auth_cookie();

		if ( $user_id )

			return new WP_User($user_id);

		global $auth_secure_cookie;

		if ( $auth_secure_cookie )

			$auth_cookie = SECURE_AUTH_COOKIE;

		else

			$auth_cookie = AUTH_COOKIE;

		if ( !empty($_COOKIE[$auth_cookie]) )

			return new WP_Error('expired_session', __('Please log in again.'));

		// If the cookie is not set, be silent.

	}

	return $user;

}

/**

 * Number of posts user has written.

 *

 * @since 3.0.0

 * @uses $wpdb WordPress database object for queries.

 *

 * @param int $userid User ID.

 * @return int Amount of posts user has written.

 */

function count_user_posts($userid) {

	global $wpdb;

	$where = get_posts_by_author_sql('post', true, $userid);

	$count = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->posts $where" );

	return apply_filters('get_usernumposts', $count, $userid);

}

/**

 * Number of posts written by a list of users.

 *

 * @since 3.0.0

 *

 * @param array $users Array of user IDs.

 * @param string|array $post_type Optional. Post type to check. Defaults to post.

 * @return array Amount of posts each user has written.

 */

function count_many_users_posts( $users, $post_type = 'post' ) {

	global $wpdb;

	$count = array();

	if ( empty( $users ) || ! is_array( $users ) )

		return $count;

	$userlist = implode( ',', array_map( 'absint', $users ) );

	$where = get_posts_by_author_sql( $post_type );

	$result = $wpdb->get_results( "SELECT post_author, COUNT(*) FROM $wpdb->posts $where AND post_author IN ($userlist) GROUP BY post_author", ARRAY_N );

	foreach ( $result as $row ) {

		$count[ $row[0] ] = $row[1];

	}

	foreach ( $users as $id ) {

		if ( ! isset( $count[ $id ] ) )

			$count[ $id ] = 0;

	}

	return $count;

}

/**

 * Check that the user login name and password is correct.

 *

 * @since 0.71

 * @todo xmlrpc only. Maybe move to xmlrpc.php.

 *

 * @param string $user_login User name.

 * @param string $user_pass User password.

 * @return bool False if does not authenticate, true if username and password authenticates.

 */

function user_pass_ok($user_login, $user_pass) {

	$user = wp_authenticate($user_login, $user_pass);

	if ( is_wp_error($user) )

		return false;

	return true;

}

//

// User option functions

//

/**

 * Get the current user's ID

 *

 * @since MU

 *

 * @uses wp_get_current_user

 *

 * @return int The current user's ID

 */

function get_current_user_id() {

	$user = wp_get_current_user();

	return ( isset( $user->ID ) ? (int) $user->ID : 0 );

}

/**

 * Retrieve user option that can be either per Site or per Network.

 *

 * If the user ID is not given, then the current user will be used instead. If

 * the user ID is given, then the user data will be retrieved. The filter for

 * the result, will also pass the original option name and finally the user data

 * object as the third parameter.

 *

 * The option will first check for the per site name and then the per Network name.

 *

 * @since 2.0.0

 * @uses $wpdb WordPress database object for queries.

 * @uses apply_filters() Calls 'get_user_option_$option' hook with result,

 *		option parameter, and user data object.

 *

 * @param string $option User option name.

 * @param int $user Optional. User ID.

 * @param bool $deprecated Use get_option() to check for an option in the options table.

 * @return mixed

 */

function get_user_option( $option, $user = 0, $deprecated = '' ) {

	global $wpdb;

	if ( !empty( $deprecated ) )

		_deprecated_argument( __FUNCTION__, '3.0' );

	if ( empty( $user ) )

		$user = wp_get_current_user();

	else

		$user = new WP_User( $user );

	if ( ! $user->exists() )

		return false;

	if ( $user->has_prop( $wpdb->prefix . $option ) ) // Blog specific

		$result = $user->get( $wpdb->prefix . $option );

	elseif ( $user->has_prop( $option ) ) // User specific and cross-blog

		$result = $user->get( $option );

	else

		$result = false;

	return apply_filters("get_user_option_{$option}", $result, $option, $user);

}

/**

 * Update user option with global blog capability.

 *

 * User options are just like user metadata except that they have support for

 * global blog options. If the 'global' parameter is false, which it is by default

 * it will prepend the WordPress table prefix to the option name.

 *

 * Deletes the user option if $newvalue is empty.

 *

 * @since 2.0.0

 * @uses $wpdb WordPress database object for queries

 *

 * @param int $user_id User ID

 * @param string $option_name User option name.

 * @param mixed $newvalue User option value.

 * @param bool $global Optional. Whether option name is global or blog specific. Default false (blog specific).

 * @return unknown

 */

function update_user_option( $user_id, $option_name, $newvalue, $global = false ) {

	global $wpdb;

	if ( !$global )

		$option_name = $wpdb->prefix . $option_name;

	// For backward compatibility. See differences between update_user_meta() and deprecated update_usermeta().

	// http://core.trac.wordpress.org/ticket/13088

	if ( is_null( $newvalue ) || is_scalar( $newvalue ) && empty( $newvalue ) )

		return delete_user_meta( $user_id, $option_name );

	return update_user_meta( $user_id, $option_name, $newvalue );

}

/**

 * Delete user option with global blog capability.

 *

 * User options are just like user metadata except that they have support for

 * global blog options. If the 'global' parameter is false, which it is by default

 * it will prepend the WordPress table prefix to the option name.

 *

 * @since 3.0.0

 * @uses $wpdb WordPress database object for queries

 *

 * @param int $user_id User ID

 * @param string $option_name User option name.

 * @param bool $global Optional. Whether option name is global or blog specific. Default false (blog specific).

 * @return unknown

 */

function delete_user_option( $user_id, $option_name, $global = false ) {

	global $wpdb;

	if ( !$global )

		$option_name = $wpdb->prefix . $option_name;

	return delete_user_meta( $user_id, $option_name );

}

/**

 * WordPress User Query class.

 *

 * @since 3.1.0

 */

class WP_User_Query {

	/**

	 * List of found user ids

	 *

	 * @since 3.1.0

	 * @access private

	 * @var array

	 */

	var $results;

	/**

	 * Total number of found users for the current query

	 *

	 * @since 3.1.0

	 * @access private

	 * @var int

	 */

	var $total_users = 0;

	// SQL clauses

	var $query_fields;

	var $query_from;

	var $query_where;

	var $query_orderby;

	var $query_limit;

	/**

	 * PHP5 constructor

	 *

	 * @since 3.1.0

	 *

	 * @param string|array $args The query variables

	 * @return WP_User_Query

	 */

	function __construct( $query = null ) {

		if ( !empty( $query ) ) {

			$this->query_vars = wp_parse_args( $query, array(

				'blog_id' => $GLOBALS['blog_id'],

				'role' => '',

				'meta_key' => '',

				'meta_value' => '',

				'meta_compare' => '',

				'include' => array(),

				'exclude' => array(),

				'search' => '',

				'search_columns' => array(),

				'orderby' => 'login',

				'order' => 'ASC',

				'offset' => '',

				'number' => '',

				'count_total' => true,

				'fields' => 'all',

				'who' => ''

			) );

			$this->prepare_query();

			$this->query();

		}

	}

	/**

	 * Prepare the query variables

	 *

	 * @since 3.1.0

	 * @access private

	 */

	function prepare_query() {

		global $wpdb;

		$qv = &$this->query_vars;

		if ( is_array( $qv['fields'] ) ) {

			$qv['fields'] = array_unique( $qv['fields'] );

			$this->query_fields = array();

			foreach ( $qv['fields'] as $field )

				$this->query_fields[] = $wpdb->users . '.' . esc_sql( $field );

			$this->query_fields = implode( ',', $this->query_fields );

		} elseif ( 'all' == $qv['fields'] ) {

			$this->query_fields = "$wpdb->users.*";

		} else {