UsersTable.php

Go to the documentation of this file.

<?php

namespace Elgg\Database;

use Elgg\Cache\EntityCache;
use Elgg\Config as Conf;
use Elgg\Database;
use Elgg\Database\EntityTable;
use Elgg\EventsService;
use ElggUser;
use RegistrationException;

class UsersTable {

    use \Elgg\TimeUsing;

    protected $config;

    protected $db;

    protected $entities;

    protected $entity_cache;

    protected $events;

    protected $table;

    public function __construct(
    Conf $config, Database $db, EntityTable $entities, EntityCache $cache, EventsService $events
    ) {
        $this->config = $config;
        $this->db = $db;
        $this->table = $this->db->prefix . "users_entity";
        $this->entities = $entities;
        $this->entity_cache = $cache;
        $this->events = $events;
    }

    public function getRow($guid) {
        $sql = "
            SELECT * FROM {$this->table}
            WHERE guid = :guid
        ";
        $params = [
            ':guid' => $guid,
        ];
        return $this->db->getDataRow($sql, null, $params);
    }

    public function disableEntities($owner_guid) {
        return $this->entities->disableEntities($owner_guid);
    }

    public function ban($user_guid, $reason = "") {

        $user = get_entity($user_guid);

        if (!$user instanceof ElggUser || !$user->canEdit()) {
            return false;
        }

        if (!$this->events->trigger('ban', 'user', $user)) {
            return false;
        }

        create_metadata($user_guid, 'ban_reason', $reason, '', 0, ACCESS_PUBLIC);

        _elgg_invalidate_cache_for_entity($user_guid);
        _elgg_invalidate_memcache_for_entity($user_guid);

        if ($this->markBanned($user_guid, true)) {
            return true;
        }

        return false;
    }

    public function markBanned($guid, $banned) {

        $query = "
            UPDATE {$this->table}
            SET banned = :banned
            WHERE guid = :guid
        ";

        $params = [
            ':banned' => $banned ? 'yes' : 'no',
            ':guid' => (int) $guid,
        ];

        return $this->db->updateData($query, true, $params);
    }

    public function unban($user_guid) {

        $user = get_entity($user_guid);

        if (!$user instanceof ElggUser || !$user->canEdit()) {
            return false;
        }

        if (!$this->events->trigger('unban', 'user', $user)) {
            return false;
        }

        create_metadata($user_guid, 'ban_reason', '', '', 0, ACCESS_PUBLIC);

        _elgg_invalidate_cache_for_entity($user_guid);
        _elgg_invalidate_memcache_for_entity($user_guid);

        return $this->markBanned($user_guid, false);
    }

    public function makeAdmin($user_guid) {
        $user = get_entity($user_guid);

        if (!$user instanceof ElggUser || !$user->canEdit()) {
            return false;
        }

        if (!$this->events->trigger('make_admin', 'user', $user)) {
            return false;
        }

        $query = "
            UPDATE {$this->table}
            SET admin = 'yes'
            WHERE guid = :guid
        ";

        $params = [
            ':guid' => (int) $user_guid,
        ];

        _elgg_invalidate_cache_for_entity($user_guid);
        _elgg_invalidate_memcache_for_entity($user_guid);

        if ($this->db->updateData($query, true, $params)) {
            return true;
        }

        return false;
    }

    public function removeAdmin($user_guid) {

        $user = get_entity($user_guid);

        if (!$user instanceof ElggUser || !$user->canEdit()) {
            return false;
        }

        if (!$this->events->trigger('remove_admin', 'user', $user)) {
            return false;
        }

        $query = "
            UPDATE {$this->table}
            SET admin = 'no'
            WHERE guid = :guid
        ";

        $params = [
            ':guid' => (int) $user_guid,
        ];

        _elgg_invalidate_cache_for_entity($user_guid);
        _elgg_invalidate_memcache_for_entity($user_guid);

        if ($this->db->updateData($query, true, $params)) {
            return true;
        }

        return false;
    }

    public function getByUsername($username) {

        // Fixes #6052. Username is frequently sniffed from the path info, which,
        // unlike $_GET, is not URL decoded. If the username was not URL encoded,
        // this is harmless.
        $username = rawurldecode($username);

        if (!$username) {
            return false;
        }

        $entity = $this->entity_cache->getByUsername($username);
        if ($entity) {
            return $entity;
        }

        $users = $this->entities->getEntitiesFromAttributes([
            'types' => 'user',
            'attribute_name_value_pairs' => [
                'name' => 'username',
                'value' => $username,
            ],
            'limit' => 1,
        ]);
        return $users ? $users[0] : false;
    }

    public function getByEmail($email) {
        if (!$email) {
            return [];
        }

        $users = $this->entities->getEntitiesFromAttributes([
            'types' => 'user',
            'attribute_name_value_pairs' => [
                'name' => 'email',
                'value' => $email,
            ],
            'limit' => 1,
        ]);

        return $users ? : [];
    }

    public function findActive($options = array(), $limit = 10, $offset = 0, $count = false) {

        $seconds = 600; //default value

        if (!is_array($options)) {
            elgg_deprecated_notice("find_active_users() now accepts an \$options array", 1.9);
            if (!$options) {
                $options = $seconds; //assign default value
            }
            $options = array('seconds' => $options);
        }

        if ($limit === null) {
            $limit = $this->config->get('default_limit');
        }

        $options = array_merge(array(
            'seconds' => $seconds,
            'limit' => $limit,
            'offset' => $offset,
            'count' => $count,
        ), $options);

        // cast options we're sending to hook
        foreach (array('seconds', 'limit', 'offset') as $key) {
            $options[$key] = (int) $options[$key];
        }
        $options['count'] = (bool) $options['count'];

        // allow plugins to override
        $params = array(
            'seconds' => $options['seconds'],
            'limit' => $options['limit'],
            'offset' => $options['offset'],
            'count' => $options['count'],
            'options' => $options,
        );
        $data = _elgg_services()->hooks->trigger('find_active_users', 'system', $params, null);
        // check null because the handler could legitimately return falsey values.
        if ($data !== null) {
            return $data;
        }

        $dbprefix = $this->config->get('dbprefix');
        $time = $this->getCurrentTime()->getTimestamp() - $options['seconds'];
        return elgg_get_entities(array(
            'type' => 'user',
            'limit' => $options['limit'],
            'offset' => $options['offset'],
            'count' => $options['count'],
            'joins' => array("join {$dbprefix}users_entity u on e.guid = u.guid"),
            'wheres' => array("u.last_action >= {$time}"),
            'order_by' => "u.last_action desc",
        ));
    }

    public function register($username, $password, $name, $email, $allow_multiple_emails = false) {

        // no need to trim password
        $username = trim($username);
        $name = trim(strip_tags($name));
        $email = trim($email);

        // A little sanity checking
        if (empty($username) || empty($password) || empty($name) || empty($email)) {
            return false;
        }

        // Make sure a user with conflicting details hasn't registered and been disabled
        $access_status = access_get_show_hidden_status();
        access_show_hidden_entities(true);

        if (!validate_email_address($email)) {
            throw new RegistrationException(_elgg_services()->translator->translate('registration:emailnotvalid'));
        }

        if (!validate_password($password)) {
            throw new RegistrationException(_elgg_services()->translator->translate('registration:passwordnotvalid'));
        }

        if (!validate_username($username)) {
            throw new RegistrationException(_elgg_services()->translator->translate('registration:usernamenotvalid'));
        }

        if ($user = get_user_by_username($username)) {
            throw new RegistrationException(_elgg_services()->translator->translate('registration:userexists'));
        }

        if ((!$allow_multiple_emails) && (get_user_by_email($email))) {
            throw new RegistrationException(_elgg_services()->translator->translate('registration:dupeemail'));
        }

        access_show_hidden_entities($access_status);

        // Create user
        $user = new ElggUser();
        $user->username = $username;
        $user->email = $email;
        $user->name = $name;
        $user->access_id = ACCESS_PUBLIC;
        $user->setPassword($password);
        $user->owner_guid = 0; // Users aren't owned by anyone, even if they are admin created.
        $user->container_guid = 0; // Users aren't contained by anyone, even if they are admin created.
        $user->language = _elgg_services()->translator->getCurrentLanguage();
        if ($user->save() === false) {
            return false;
        }

        // Turn on email notifications by default
        $user->setNotificationSetting('email', true);
    
        return $user->getGUID();
    }

    public function generateInviteCode($username) {
        $time = $this->getCurrentTime()->getTimestamp();
        return "$time." . _elgg_services()->crypto->getHmac([(int) $time, $username])->getToken();
    }

    public function validateInviteCode($username, $code) {
        // validate the format of the token created by ->generateInviteCode()
        if (!preg_match('~^(\d+)\.([a-zA-Z0-9\-_]+)$~', $code, $m)) {
            return false;
        }
        $time = $m[1];
        $mac = $m[2];

        return _elgg_services()->crypto->getHmac([(int) $time, $username])->matchesToken($mac);
    }

    public function setValidationStatus($user_guid, $status, $method = '') {
        $result1 = create_metadata($user_guid, 'validated', $status, '', 0, ACCESS_PUBLIC, false);
        $result2 = create_metadata($user_guid, 'validated_method', $method, '', 0, ACCESS_PUBLIC, false);
        if ($result1 && $result2) {
            return true;
        } else {
            return false;
        }
    }

    public function getValidationStatus($user_guid) {
        $user = get_entity($user_guid);
        if (!$user || !isset($user->validated)) {
            return null;
        }
        return (bool) $user->validated;
    }

    public function setLastAction(ElggUser $user) {

        $time = $this->getCurrentTime()->getTimestamp();

        if ($user->last_action == $time) {
            // no change required
            return;
        }

        $query = "
            UPDATE {$this->table}
            SET
                prev_last_action = last_action,
                last_action = :last_action
            WHERE guid = :guid
        ";

        $params = [
            ':last_action' => $time,
            ':guid' => (int) $user->guid,
        ];

        $user->prev_last_action = $user->last_action;
        $user->last_action = $time;

        execute_delayed_write_query($query, null, $params);

        $this->entity_cache->set($user);

        // If we save the user to memcache during this request, then we'll end up with the
        // old (incorrect) attributes cached (notice the above query is delayed). So it's
        // simplest to just resave the user after all plugin code runs.
        register_shutdown_function(function () use ($user, $time) {
            $this->entities->updateLastAction($user, $time); // keep entity table in sync
            $user->storeInPersistedCache(_elgg_get_memcache('new_entity_cache'), $time);
        });
    }

    public function setLastLogin(ElggUser $user) {

        $time = $this->getCurrentTime()->getTimestamp();

        if ($user->last_login == $time) {
            // no change required
            return;
        }

        $query = "
            UPDATE {$this->table}
            SET
                prev_last_login = last_login,
                last_login = :last_login
            WHERE guid = :guid
        ";

        $params = [
            ':last_login' => $time,
            ':guid' => (int) $user->guid,
        ];

        $user->prev_last_login = $user->last_login;
        $user->last_login = $time;

        execute_delayed_write_query($query, null, $params);

        $this->entity_cache->set($user);

        // If we save the user to memcache during this request, then we'll end up with the
        // old (incorrect) attributes cached. Hence we want to invalidate as late as possible.
        // the user object gets saved
        register_shutdown_function(function () use ($user) {
            $user->storeInPersistedCache(_elgg_get_memcache('new_entity_cache'));
        });
    }

}