user.module 129 KB
Newer Older
Dries's avatar
   
Dries committed
1
2
<?php

3
use Drupal\Core\Database\Query\SelectInterface;
Crell's avatar
Crell committed
4

Dries's avatar
   
Dries committed
5
6
7
8
9
/**
 * @file
 * Enables the user registration and login system.
 */

10
11
12
/**
 * Maximum length of username text field.
 */
13
const USERNAME_MAX_LENGTH = 60;
14
15
16
17

/**
 * Maximum length of user e-mail text field.
 */
18
const EMAIL_MAX_LENGTH = 254;
19

20
21
22
/**
 * Only administrators can create user accounts.
 */
23
const USER_REGISTER_ADMINISTRATORS_ONLY = 0;
24
25
26
27

/**
 * Visitors can create their own accounts.
 */
28
const USER_REGISTER_VISITORS = 1;
29
30
31
32
33

/**
 * Visitors can create accounts, but they don't become active without
 * administrative approval.
 */
34
const USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL = 2;
35

36
37
38
39
40
41
42
43
44
45
/**
 * Implement hook_help().
 */
function user_help($path, $arg) {
  global $user;

  switch ($path) {
    case 'admin/help#user':
      $output = '';
      $output .= '<h3>' . t('About') . '</h3>';
46
      $output .= '<p>' . t('The User module allows users to register, log in, and log out. It also allows users with proper permissions to manage user roles (used to classify users) and permissions associated with those roles. For more information, see the online handbook entry for <a href="@user">User module</a>.', array('@user' => 'http://drupal.org/documentation/modules/user')) . '</p>';
47
48
49
      $output .= '<h3>' . t('Uses') . '</h3>';
      $output .= '<dl>';
      $output .= '<dt>' . t('Creating and managing users') . '</dt>';
50
      $output .= '<dd>' . t('The User module allows users with the appropriate <a href="@permissions">permissions</a> to create user accounts through the <a href="@people">People administration page</a>, where they can also assign users to one or more roles, and block or delete user accounts. If allowed, users without accounts (anonymous users) can create their own accounts on the <a href="@register">Create new account</a> page.', array('@permissions' => url('admin/people/permissions', array('fragment' => 'module-user')), '@people' => url('admin/people'), '@register' => url('user/register'))) . '</dd>';
51
      $output .= '<dt>' . t('User roles and permissions') . '</dt>';
52
      $output .= '<dd>' . t('<em>Roles</em> are used to group and classify users; each user can be assigned one or more roles. By default there are two roles: <em>anonymous user</em> (users that are not logged in) and <em>authenticated user</em> (users that are registered and logged in). Depending on choices you made when you installed Drupal, the installation process may have defined more roles, and you can create additional custom roles on the <a href="@roles">Roles page</a>. After creating roles, you can set permissions for each role on the <a href="@permissions_user">Permissions page</a>. Granting a permission allows users who have been assigned a particular role to perform an action on the site, such as viewing a particular type of content, editing or creating content, administering settings for a particular module, or using a particular function of the site (such as search).', array('@permissions_user' => url('admin/people/permissions'), '@roles' => url('admin/people/permissions/roles'))) . '</dd>';
53
      $output .= '<dt>' . t('Account settings') . '</dt>';
54
      $output .= '<dd>' . t('The <a href="@accounts">Account settings page</a> allows you to manage settings for the displayed name of the anonymous user role, personal contact forms, user registration, and account cancellation. On this page you can also manage settings for account personalization (including signatures and user pictures), and adapt the text for the e-mail messages that are sent automatically during the user registration process.', array('@accounts'  => url('admin/config/people/accounts'))) . '</dd>';
55
56
57
58
      $output .= '</dl>';
      return $output;
    case 'admin/people/create':
      return '<p>' . t("This web page allows administrators to register new users. Users' e-mail addresses and usernames must be unique.") . '</p>';
59
    case 'admin/people/permissions':
60
      return '<p>' . t('Permissions let you control what users can do and see on your site. You can define a specific set of permissions for each role. (See the <a href="@role">Roles</a> page to create a role). Two important roles to consider are Authenticated Users and Administrators. Any permissions granted to the Authenticated Users role will be given to any user who can log into your site. You can make any role the Administrator role for the site, meaning this will be granted all new permissions automatically. You can do this on the <a href="@settings">User Settings</a> page. You should be careful to ensure that only trusted users are given this access and level of control of your site.', array('@role' => url('admin/people/permissions/roles'), '@settings' => url('admin/config/people/accounts'))) . '</p>';
61
    case 'admin/people/permissions/roles':
62
      $output = '<p>' . t('Roles allow you to fine tune the security and administration of Drupal. A role defines a group of users that have certain privileges as defined on the <a href="@permissions">permissions page</a>. Examples of roles include: anonymous user, authenticated user, moderator, administrator and so on. In this area you will define the names and order of the roles on your site. It is recommended to order your roles from least permissive (anonymous user) to most permissive (administrator). To delete a role choose "edit role".', array('@permissions' => url('admin/people/permissions'))) . '</p>';
63
      $output .= '<p>' . t('Drupal has three special user roles:') . '</p>';
64
65
66
      $output .= '<ul>';
      $output .= '<li>' . t("Anonymous user: this role is used for users that don't have a user account or that are not authenticated.") . '</li>';
      $output .= '<li>' . t('Authenticated user: this role is automatically granted to all logged in users.') . '</li>';
67
      $output .= '<li>' . t('Administrator role: this role is automatically granted all new permissions when you install a new module. Configure which role is the administrator role on the <a href="@account_settings">Account settings page</a>.', array('@account_settings' => url('admin/config/people/accounts'))) . '</li>';
68
69
70
71
72
73
74
75
76
77
      $output .= '</ul>';
      return $output;
    case 'admin/config/people/accounts/fields':
      return '<p>' . t('This form lets administrators add, edit, and arrange fields for storing user data.') . '</p>';
    case 'admin/config/people/accounts/display':
      return '<p>' . t('This form lets administrators configure how fields should be displayed when rendering a user profile page.') . '</p>';
    case 'admin/people/search':
      return '<p>' . t('Enter a simple pattern ("*" may be used as a wildcard match) to search for a username or e-mail address. For example, one may search for "br" and Drupal might return "brian", "brad", and "brenda@example.com".') . '</p>';
  }
}
78

Dries's avatar
Dries committed
79
/**
80
 * Invokes a user hook in every module.
Dries's avatar
Dries committed
81
 *
82
 * We cannot use module_invoke() for this, because the arguments need to
Dries's avatar
Dries committed
83
 * be passed by reference.
84
85
 *
 * @param $type
86
 *   A text string that controls which user hook to invoke. Valid choices are:
87
88
89
90
91
92
93
 *   - login: Invokes hook_user_login().
 * @param $edit
 *   An associative array variable containing form values to be passed
 *   as the first parameter of the hook function.
 * @param $account
 *   The user account object to be passed as the second parameter of the hook
 *   function.
Dries's avatar
Dries committed
94
 */
95
function user_module_invoke($type, &$edit, $account) {
96
  foreach (module_implements('user_' . $type) as $module) {
97
    $function = $module . '_user_' . $type;
98
    $function($edit, $account);
Dries's avatar
   
Dries committed
99
100
101
  }
}

102
/**
103
 * Implements hook_theme().
104
105
106
107
 */
function user_theme() {
  return array(
    'user_picture' => array(
108
      'variables' => array('account' => NULL),
109
      'template' => 'user-picture',
110
111
    ),
    'user_profile' => array(
112
      'render element' => 'elements',
113
      'template' => 'user-profile',
114
      'file' => 'user.pages.inc',
115
    ),
116
    'user_list' => array(
117
      'variables' => array('users' => NULL, 'title' => NULL),
118
    ),
119
    'user_admin_permissions' => array(
120
      'render element' => 'form',
121
      'file' => 'user.admin.inc',
122
    ),
123
    'user_admin_roles' => array(
124
      'render element' => 'form',
125
      'file' => 'user.admin.inc',
126
    ),
127
128
129
130
    'user_permission_description' => array(
      'variables' => array('permission_item' => NULL, 'hide' => NULL),
      'file' => 'user.admin.inc',
    ),
131
    'user_signature' => array(
132
      'variables' => array('signature' => NULL),
133
    ),
134
135
136
    'username' => array(
      'variables' => array('account' => NULL),
    ),
137
138
139
  );
}

Dries's avatar
   
Dries committed
140
/**
141
 * Implements hook_entity_info().
Dries's avatar
   
Dries committed
142
 */
143
function user_entity_info() {
144
  return array(
Dries's avatar
   
Dries committed
145
    'user' => array(
146
      'label' => t('User'),
147
      'controller class' => 'Drupal\user\UserStorageController',
148
      'base table' => 'users',
149
      'uri callback' => 'user_uri',
150
      'label callback' => 'user_label',
151
      'fieldable' => TRUE,
152
      'entity class' => 'Drupal\user\User',
153
      'entity keys' => array(
154
155
156
157
158
159
        'id' => 'uid',
      ),
      'bundles' => array(
        'user' => array(
          'label' => t('User'),
          'admin' => array(
160
            'path' => 'admin/config/people/accounts',
161
162
163
164
            'access arguments' => array('administer users'),
          ),
        ),
      ),
165
166
167
      'view modes' => array(
        'full' => array(
          'label' => t('User account'),
168
          'custom settings' => FALSE,
169
170
        ),
      ),
Dries's avatar
   
Dries committed
171
172
173
174
    ),
  );
}

175
/**
176
 * Entity uri callback.
177
 */
178
179
180
181
function user_uri($user) {
  return array(
    'path' => 'user/' . $user->uid,
  );
182
183
}

184
185
186
187
188
189
190
191
192
193
194
/**
 * Entity label callback.
 *
 * @param $entity_type
 *   The entity type.
 * @param $entity
 *   The entity object.
 *
 * @return
 *   The name of the user.
 *
195
 * @see user_format_name()
196
197
 */
function user_label($entity_type, $entity) {
198
  return user_format_name($entity);
199
200
}

201
202
203
204
205
/**
 * Implements hook_field_info_alter().
 */
function user_field_info_alter(&$info) {
  // Add the 'user_register_form' instance setting to all field types.
206
207
208
  foreach ($info as $field_type => &$field_type_info) {
    $field_type_info += array('instance_settings' => array());
    $field_type_info['instance_settings'] += array(
209
210
211
212
213
      'user_register_form' => FALSE,
    );
  }
}

214
/**
215
 * Implements hook_field_extra_fields().
216
 */
217
218
function user_field_extra_fields() {
  $return['user']['user'] = array(
219
220
    'form' => array(
      'account' => array(
221
222
        'label' => t('User name and password'),
        'description' => t('User module account form elements.'),
223
224
225
        'weight' => -10,
      ),
      'timezone' => array(
226
        'label' => t('Timezone'),
227
228
229
        'description' => t('User module timezone form element.'),
        'weight' => 6,
      ),
230
    ),
231
    'display' => array(
232
233
234
      'member_for' => array(
        'label' => t('Member for'),
        'description' => t('User module \'member for\' view element.'),
235
236
        'weight' => 5,
      ),
237
238
    ),
  );
239

240
  return $return;
241
242
}

243
244
245
246
247
248
249
250
251
/**
 * Fetches a user object based on an external authentication source.
 *
 * @param string $authname
 *   The external authentication username.
 *
 * @return
 *   A fully-loaded user object if the user is found or FALSE if not found.
 */
Dries's avatar
   
Dries committed
252
function user_external_load($authname) {
253
  $uid = db_query("SELECT uid FROM {authmap} WHERE authname = :authname", array(':authname' => $authname))->fetchField();
Dries's avatar
   
Dries committed
254

255
256
  if ($uid) {
    return user_load($uid);
Dries's avatar
   
Dries committed
257
258
  }
  else {
259
    return FALSE;
Dries's avatar
   
Dries committed
260
261
262
  }
}

Dries's avatar
Dries committed
263
/**
264
 * Loads multiple users based on certain conditions.
Dries's avatar
Dries committed
265
 *
266
267
268
 * This function should be used whenever you need to load more than one user
 * from the database. Users are loaded into memory and will not require
 * database access if loaded again during the same page request.
Dries's avatar
Dries committed
269
 *
270
271
272
 * @param array|bool $uids
 *   An array of user IDs, or FALSE to load all users.
 * @param array $conditions
273
274
275
276
277
 *   (deprecated) An associative array of conditions on the {users}
 *   table, where the keys are the database fields and the values are the
 *   values those fields must have. Instead, it is preferable to use
 *   EntityFieldQuery to retrieve a list of entity IDs loadable by
 *   this function.
278
 * @param bool $reset
279
280
 *   A boolean indicating that the internal cache should be reset. Use this if
 *   loading a user object which has been altered during the page request.
281
 *
282
 * @return array
283
284
 *   An array of user objects, indexed by uid.
 *
285
 * @see entity_load_multiple()
286
287
288
 * @see user_load()
 * @see user_load_by_mail()
 * @see user_load_by_name()
289
290
291
 * @see EntityFieldQuery
 *
 * @todo Remove $conditions in Drupal 8.
Dries's avatar
Dries committed
292
 */
293
294
function user_load_multiple($uids = array(), array $conditions = array(), $reset = FALSE) {
  return entity_load_multiple('user', $uids, $conditions, $reset);
295
}
296
297

/**
298
299
300
301
302
303
 * Loads a user object.
 *
 * Drupal has a global $user object, which represents the currently-logged-in
 * user. So to avoid confusion and to avoid clobbering the global $user object,
 * it is a good idea to assign the result of this function to a different local
 * variable, generally $account. If you actually do want to act as the user you
304
305
306
307
 * are loading, it is essential to call drupal_save_session(FALSE); first.
 * See
 * @link http://drupal.org/node/218104 Safely impersonating another user @endlink
 * for more information.
308
 *
309
 * @param int $uid
310
 *   Integer specifying the user ID to load.
311
 * @param bool $reset
312
313
314
 *   TRUE to reset the internal cache and load from the database; FALSE
 *   (default) to load from the internal cache, if set.
 *
315
 * @return object
316
 *   A fully-loaded user object upon successful user load, or FALSE if the user
317
318
319
320
321
 *   cannot be loaded.
 *
 * @see user_load_multiple()
 */
function user_load($uid, $reset = FALSE) {
322
  return entity_load('user', $uid, $reset);
323
324
325
}

/**
326
 * Fetches a user object by email address.
327
 *
328
 * @param string $mail
329
 *   String with the account's e-mail address.
330
 * @return object|bool
331
332
333
334
335
336
 *   A fully-loaded $user object upon successful user load or FALSE if user
 *   cannot be loaded.
 *
 * @see user_load_multiple()
 */
function user_load_by_mail($mail) {
337
  $users = entity_load_multiple('user', FALSE, array('mail' => $mail));
338
339
340
341
  return reset($users);
}

/**
342
 * Fetches a user object by account name.
343
 *
344
 * @param string $name
345
 *   String with the account's user name.
346
 * @return object|bool
347
348
349
350
351
352
 *   A fully-loaded $user object upon successful user load or FALSE if user
 *   cannot be loaded.
 *
 * @see user_load_multiple()
 */
function user_load_by_name($name) {
353
  $users = entity_load_multiple('user', FALSE, array('name' => $name));
354
  return reset($users);
Dries's avatar
   
Dries committed
355
356
}

Dries's avatar
Dries committed
357
358
359
/**
 * Verify the syntax of the given name.
 */
Dries's avatar
   
Dries committed
360
function user_validate_name($name) {
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
  if (!$name) {
    return t('You must enter a username.');
  }
  if (substr($name, 0, 1) == ' ') {
    return t('The username cannot begin with a space.');
  }
  if (substr($name, -1) == ' ') {
    return t('The username cannot end with a space.');
  }
  if (strpos($name, '  ') !== FALSE) {
    return t('The username cannot contain multiple spaces in a row.');
  }
  if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.\'-]/i', $name)) {
    return t('The username contains an illegal character.');
  }
376
  if (preg_match('/[\x{80}-\x{A0}' .         // Non-printable ISO-8859-1 + NBSP
377
378
379
380
381
382
383
384
385
                  '\x{AD}' .                // Soft-hyphen
                  '\x{2000}-\x{200F}' .     // Various space characters
                  '\x{2028}-\x{202F}' .     // Bidirectional text overrides
                  '\x{205F}-\x{206F}' .     // Various text hinting characters
                  '\x{FEFF}' .              // Byte order mark
                  '\x{FF01}-\x{FF60}' .     // Full-width latin
                  '\x{FFF9}-\x{FFFD}' .     // Replacement characters
                  '\x{0}-\x{1F}]/u',        // NULL byte and control characters
                  $name)) {
386
387
    return t('The username contains an illegal character.');
  }
388
389
390
  if (drupal_strlen($name) > USERNAME_MAX_LENGTH) {
    return t('The username %name is too long: it must be %max characters or less.', array('%name' => $name, '%max' => USERNAME_MAX_LENGTH));
  }
Dries's avatar
   
Dries committed
391
392
}

393
394
395
396
397
/**
 * Validates an image uploaded by a user.
 *
 * @see user_account_form()
 */
398
function user_validate_picture(&$form, &$form_state) {
399
  // If required, validate the uploaded picture.
400
401
402
403
404
  $validators = array(
    'file_validate_is_image' => array(),
    'file_validate_image_resolution' => array(variable_get('user_picture_dimensions', '85x85')),
    'file_validate_size' => array(variable_get('user_picture_file_size', '30') * 1024),
  );
405

406
407
408
409
410
411
412
  // Save the file as a temporary file.
  $file = file_save_upload('picture_upload', $validators);
  if ($file === FALSE) {
    form_set_error('picture_upload', t("Failed to upload the picture image; the %directory directory doesn't exist or is not writable.", array('%directory' => variable_get('user_picture_path', 'pictures'))));
  }
  elseif ($file !== NULL) {
    $form_state['values']['picture_upload'] = $file;
Dries's avatar
   
Dries committed
413
414
415
  }
}

Dries's avatar
Dries committed
416
417
418
/**
 * Generate a random alphanumeric password.
 */
Dries's avatar
   
Dries committed
419
420
function user_password($length = 10) {
  // This variable contains the list of allowable characters for the
421
422
  // password. Note that the number 0 and the letter 'O' have been
  // removed to avoid confusion between the two. The same is true
423
  // of 'I', 1, and 'l'.
424
  $allowable_characters = 'abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';
Dries's avatar
Dries committed
425

426
427
  // Zero-based count of characters in the allowable list:
  $len = strlen($allowable_characters) - 1;
Dries's avatar
   
Dries committed
428

Dries's avatar
Dries committed
429
430
  // Declare the password as a blank string.
  $pass = '';
Dries's avatar
   
Dries committed
431

Dries's avatar
Dries committed
432
  // Loop the number of times specified by $length.
Dries's avatar
   
Dries committed
433
434
435
436
  for ($i = 0; $i < $length; $i++) {

    // Each iteration, pick a random character from the
    // allowable string and append it to the password:
437
    $pass .= $allowable_characters[mt_rand(0, $len)];
Dries's avatar
   
Dries committed
438
439
440
  }

  return $pass;
Dries's avatar
   
Dries committed
441
442
}

443
444
445
446
447
448
449
450
451
452
/**
 * Determine the permissions for one or more roles.
 *
 * @param $roles
 *   An array whose keys are the role IDs of interest, such as $user->roles.
 *
 * @return
 *   An array indexed by role ID. Each value is an array whose keys are the
 *   permission strings for the given role ID.
 */
453
454
function user_role_permissions($roles = array()) {
  $cache = &drupal_static(__FUNCTION__, array());
455
456
457
458
459

  $role_permissions = $fetch = array();

  if ($roles) {
    foreach ($roles as $rid => $name) {
460
461
      if (isset($cache[$rid])) {
        $role_permissions[$rid] = $cache[$rid];
462
463
464
465
466
      }
      else {
        // Add this rid to the list of those needing to be fetched.
        $fetch[] = $rid;
        // Prepare in case no permissions are returned.
467
        $cache[$rid] = array();
468
469
470
471
472
473
      }
    }

    if ($fetch) {
      // Get from the database permissions that were not in the static variable.
      // Only role IDs with at least one permission assigned will return rows.
474
      $result = db_query("SELECT rid, permission FROM {role_permission} WHERE rid IN (:fetch)", array(':fetch' => $fetch));
475

476
      foreach ($result as $row) {
477
        $cache[$row->rid][$row->permission] = TRUE;
478
479
480
      }
      foreach ($fetch as $rid) {
        // For every rid, we know we at least assigned an empty array.
481
        $role_permissions[$rid] = $cache[$rid];
482
483
484
485
486
487
488
      }
    }
  }

  return $role_permissions;
}

Dries's avatar
Dries committed
489
490
491
492
493
/**
 * Determine whether the user has a given privilege.
 *
 * @param $string
 *   The permission, such as "administer nodes", being checked for.
Dries's avatar
   
Dries committed
494
495
 * @param $account
 *   (optional) The account to check, if not given use currently logged in user.
Dries's avatar
Dries committed
496
497
 *
 * @return
498
 *   Boolean TRUE if the current user has the requested permission.
Dries's avatar
Dries committed
499
500
501
502
503
 *
 * All permission checks in Drupal should go through this function. This
 * way, we guarantee consistent behavior, and ensure that the superuser
 * can perform all actions.
 */
504
function user_access($string, $account = NULL) {
Dries's avatar
   
Dries committed
505
  global $user;
506

507
  if (!isset($account)) {
508
509
510
    $account = $user;
  }

511
  // User #1 has all privileges:
512
  if ($account->uid == 1) {
513
    return TRUE;
Dries's avatar
   
Dries committed
514
515
  }

Dries's avatar
Dries committed
516
517
  // To reduce the number of SQL queries, we cache the user's permissions
  // in a static variable.
518
  // Use the advanced drupal_static() pattern, since this is called very often.
519
520
521
522
523
  static $drupal_static_fast;
  if (!isset($drupal_static_fast)) {
    $drupal_static_fast['perm'] = &drupal_static(__FUNCTION__);
  }
  $perm = &$drupal_static_fast['perm'];
524
  if (!isset($perm[$account->uid])) {
525
    $role_permissions = user_role_permissions($account->roles);
Dries's avatar
   
Dries committed
526

527
    $perms = array();
528
529
    foreach ($role_permissions as $one_role) {
      $perms += $one_role;
Dries's avatar
   
Dries committed
530
    }
531
    $perm[$account->uid] = $perms;
Dries's avatar
   
Dries committed
532
  }
533

534
  return isset($perm[$account->uid][$string]);
Dries's avatar
   
Dries committed
535
536
}

537
/**
538
 * Checks for usernames blocked by user administration.
539
 *
540
 * @return boolean TRUE for blocked users, FALSE for active.
541
542
 */
function user_is_blocked($name) {
543
544
545
546
547
  return db_select('users')
    ->fields('users', array('name'))
    ->condition('name', db_like($name), 'LIKE')
    ->condition('status', 0)
    ->execute()->fetchObject();
548
549
}

Dries's avatar
Dries committed
550
/**
551
 * Implements hook_permission().
Dries's avatar
Dries committed
552
 */
553
function user_permission() {
554
555
556
  return array(
    'administer permissions' =>  array(
      'title' => t('Administer permissions'),
557
      'restrict access' => TRUE,
558
559
560
    ),
    'administer users' => array(
      'title' => t('Administer users'),
561
      'restrict access' => TRUE,
562
563
    ),
    'access user profiles' => array(
564
      'title' => t('View user profiles'),
565
566
567
568
569
    ),
    'change own username' => array(
      'title' => t('Change own username'),
    ),
    'cancel account' => array(
570
      'title' => t('Cancel own user account'),
571
      'description' => t('Note: content may be kept, unpublished, deleted or transferred to the %anonymous-name user depending on the configured <a href="@user-settings-url">user settings</a>.', array('%anonymous-name' => variable_get('anonymous', t('Anonymous')), '@user-settings-url' => url('admin/config/people/accounts'))),
572
573
574
    ),
    'select account cancellation method' => array(
      'title' => t('Select method for cancelling own account'),
575
      'restrict access' => TRUE,
576
577
    ),
  );
Dries's avatar
   
Dries committed
578
579
}

Dries's avatar
Dries committed
580
/**
581
 * Implements hook_file_download().
Dries's avatar
Dries committed
582
583
584
 *
 * Ensure that user pictures (avatars) are always downloadable.
 */
585
586
587
function user_file_download($uri) {
  if (strpos(file_uri_target($uri), variable_get('user_picture_path', 'pictures') . '/picture-') === 0) {
    $info = image_get_info($uri);
588
    return array('Content-Type' => $info['mime_type']);
Dries's avatar
   
Dries committed
589
590
591
  }
}

592
/**
593
 * Implements hook_file_move().
594
 */
595
596
597
598
599
600
601
602
603
604
function user_file_move($file, $source) {
  // If a user's picture is replaced with a new one, update the record in
  // the users table.
  if (isset($file->fid) && isset($source->fid) && $file->fid != $source->fid) {
    db_update('users')
      ->fields(array(
        'picture' => $file->fid,
      ))
      ->condition('picture', $source->fid)
      ->execute();
605
606
607
608
  }
}

/**
609
 * Implements hook_file_predelete().
610
 */
611
function user_file_predelete($file) {
612
  // Remove any references to the file.
613
  db_update('users')
614
615
616
617
618
    ->fields(array('picture' => 0))
    ->condition('picture', $file->fid)
    ->execute();
}

Dries's avatar
Dries committed
619
/**
620
 * Implements hook_search_info().
Dries's avatar
Dries committed
621
 */
622
623
624
625
626
627
628
function user_search_info() {
  return array(
    'title' => 'Users',
  );
}

/**
629
 * Implements hook_search_access().
630
631
632
633
634
635
 */
function user_search_access() {
  return user_access('access user profiles');
}

/**
636
 * Implements hook_search_execute().
637
 */
638
function user_search_execute($keys = NULL, $conditions = NULL) {
639
640
641
642
  $find = array();
  // Replace wildcards with MySQL/PostgreSQL wildcards.
  $keys = preg_replace('!\*+!', '%', $keys);
  $query = db_select('users')->extend('PagerDefault');
643
  $query->fields('users', array('uid'));
644
645
  if (user_access('administer users')) {
    // Administrators can also search in the otherwise private email field.
646
    $query->fields('users', array('mail'));
647
    $query->condition(db_or()->
648
649
      condition('name', '%' . db_like($keys) . '%', 'LIKE')->
      condition('mail', '%' . db_like($keys) . '%', 'LIKE'));
650
651
  }
  else {
652
    $query->condition('name', '%' . db_like($keys) . '%', 'LIKE');
653
  }
654
  $uids = $query
655
    ->limit(15)
656
657
658
659
660
661
662
    ->execute()
    ->fetchCol();
  $accounts = user_load_multiple($uids);

  $results = array();
  foreach ($accounts as $account) {
    $result = array(
663
      'title' => user_format_name($account),
664
665
666
667
      'link' => url('user/' . $account->uid, array('absolute' => TRUE)),
    );
    if (user_access('administer users')) {
      $result['title'] .= ' (' . $account->mail . ')';
668
    }
669
    $results[] = $result;
Dries's avatar
   
Dries committed
670
  }
671
672

  return $results;
Dries's avatar
   
Dries committed
673
674
}

Dries's avatar
Dries committed
675
/**
676
 * Implements hook_user_view().
Dries's avatar
Dries committed
677
 */
678
function user_user_view($account) {
679
  $account->content['user_picture'] = array(
680
    '#markup' => theme('user_picture', array('account' => $account)),
681
682
    '#weight' => -10,
  );
683
684
  $account->content['member_for'] = array(
    '#type' => 'item',
685
686
    '#title' => t('Member for'),
    '#markup' => format_interval(REQUEST_TIME - $account->created),
687
    '#weight' => 5,
688
689
690
691
  );
}

/**
692
 * Helper function to add default user account fields to user registration and edit form.
693
 *
694
695
696
 * @see user_account_form_validate()
 * @see user_validate_current_pass()
 * @see user_validate_picture()
697
 * @see user_validate_mail()
698
 */
699
function user_account_form(&$form, &$form_state) {
700
  global $user, $language_interface;
701
702
703
704
705
706
707
708
709
710

  $account = $form['#user'];
  $register = ($form['#user']->uid > 0 ? FALSE : TRUE);

  $admin = user_access('administer users');

  $form['#validate'][] = 'user_account_form_validate';

  // Account information.
  $form['account'] = array(
711
    '#type'   => 'container',
712
713
714
715
716
717
718
719
720
    '#weight' => -10,
  );
  // Only show name field on registration form or user can change own username.
  $form['account']['name'] = array(
    '#type' => 'textfield',
    '#title' => t('Username'),
    '#maxlength' => USERNAME_MAX_LENGTH,
    '#description' => t('Spaces are allowed; punctuation is not allowed except for periods, hyphens, apostrophes, and underscores.'),
    '#required' => TRUE,
721
    '#attributes' => array('class' => array('username'), 'autocomplete' => 'off'),
722
723
    '#default_value' => (!$register ? $account->name : ''),
    '#access' => ($register || ($user->uid == $account->uid && user_access('change own username')) || $admin),
724
    '#weight' => -10,
725
726
  );

727
728
729
  // The mail field is NOT required if account originally had no mail set
  // and the user performing the edit has 'administer users' permission.
  // This allows users without e-mail address to be edited and deleted.
730
  $form['account']['mail'] = array(
731
    '#type' => 'email',
732
733
    '#title' => t('E-mail address'),
    '#description' => t('A valid e-mail address. All e-mails from the system will be sent to this address. The e-mail address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by e-mail.'),
734
    '#required' => !(empty($account->mail) && user_access('administer users')),
735
    '#default_value' => (!$register ? $account->mail : ''),
736
    '#attributes' => array('autocomplete' => 'off'),
737
738
739
740
741
742
743
744
745
746
  );

  // Display password field only for existing users or when user is allowed to
  // assign a password during registration.
  if (!$register) {
    $form['account']['pass'] = array(
      '#type' => 'password_confirm',
      '#size' => 25,
      '#description' => t('To change the current user password, enter the new password in both fields.'),
    );
747
748
749
750
751
752
753
754
755
756
757
    // To skip the current password field, the user must have logged in via a
    // one-time link and have the token in the URL.
    $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
    $protected_values = array();
    $current_pass_description = '';
    // The user may only change their own password without their current
    // password if they logged in via a one-time login link.
    if (!$pass_reset) {
      $protected_values['mail'] = $form['account']['mail']['#title'];
      $protected_values['pass'] = t('Password');
      $request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));
758
      $current_pass_description = t('Required if you want to change the %mail or %pass below. !request_new.', array('%mail' => $protected_values['mail'], '%pass' => $protected_values['pass'], '!request_new' => $request_new));
759
760
761
762
763
764
765
766
767
768
769
770
771
772
    }
    // The user must enter their current password to change to a new one.
    if ($user->uid == $account->uid) {
      $form['account']['current_pass_required_values'] = array(
        '#type' => 'value',
        '#value' => $protected_values,
      );
      $form['account']['current_pass'] = array(
        '#type' => 'password',
        '#title' => t('Current password'),
        '#size' => 25,
        '#access' => !empty($protected_values),
        '#description' => $current_pass_description,
        '#weight' => -5,
773
        '#attributes' => array('autocomplete' => 'off'),
774
775
776
      );
      $form['#validate'][] = 'user_validate_current_pass';
    }
777
778
779
780
781
782
783
784
785
786
787
  }
  elseif (!variable_get('user_email_verification', TRUE) || $admin) {
    $form['account']['pass'] = array(
      '#type' => 'password_confirm',
      '#size' => 25,
      '#description' => t('Provide a password for the new account in both fields.'),
      '#required' => TRUE,
    );
  }

  if ($admin) {
788
    $status = isset($account->status) ? $account->status : 1;
789
790
  }
  else {
791
    $status = $register ? variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_VISITORS : $account->status;
792
793
794
795
796
797
  }
  $form['account']['status'] = array(
    '#type' => 'radios',
    '#title' => t('Status'),
    '#default_value' => $status,
    '#options' => array(t('Blocked'), t('Active')),
798
    '#access' => $admin,
799
800
  );

801
  $roles = array_map('check_plain', user_roles(TRUE));
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
  // The disabled checkbox subelement for the 'authenticated user' role
  // must be generated separately and added to the checkboxes element,
  // because of a limitation in Form API not supporting a single disabled
  // checkbox within a set of checkboxes.
  // @todo This should be solved more elegantly. See issue #119038.
  $checkbox_authenticated = array(
    '#type' => 'checkbox',
    '#title' => $roles[DRUPAL_AUTHENTICATED_RID],
    '#default_value' => TRUE,
    '#disabled' => TRUE,
  );
  unset($roles[DRUPAL_AUTHENTICATED_RID]);
  $form['account']['roles'] = array(
    '#type' => 'checkboxes',
    '#title' => t('Roles'),
    '#default_value' => (!$register && isset($account->roles) ? array_keys($account->roles) : array()),
    '#options' => $roles,
    '#access' => $roles && user_access('administer permissions'),
    DRUPAL_AUTHENTICATED_RID => $checkbox_authenticated,
  );

  $form['account']['notify'] = array(
    '#type' => 'checkbox',
    '#title' => t('Notify user of new account'),
    '#access' => $register && $admin,
  );

  // Signature.
  $form['signature_settings'] = array(
    '#type' => 'fieldset',
    '#title' => t('Signature settings'),
    '#weight' => 1,
    '#access' => (!$register && variable_get('user_signatures', 0)),
  );
836

837
  $form['signature_settings']['signature'] = array(
838
    '#type' => 'text_format',
839
840
841
    '#title' => t('Signature'),
    '#default_value' => isset($account->signature) ? $account->signature : '',
    '#description' => t('Your signature will be publicly displayed at the end of your comments.'),
842
    '#format' => isset($account->signature_format) ? $account->signature_format : NULL,
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
  );

  // Picture/avatar.
  $form['picture'] = array(
    '#type' => 'fieldset',
    '#title' => t('Picture'),
    '#weight' => 1,
    '#access' => (!$register && variable_get('user_pictures', 0)),
  );
  $form['picture']['picture'] = array(
    '#type' => 'value',
    '#value' => isset($account->picture) ? $account->picture : NULL,
  );
  $form['picture']['picture_current'] = array(
    '#markup' => theme('user_picture', array('account' => $account)),
  );
  $form['picture']['picture_delete'] = array(
    '#type' => 'checkbox',
    '#title' => t('Delete picture'),
    '#access' => !empty($account->picture->fid),
    '#description' => t('Check this box to delete your current picture.'),
  );
  $form['picture']['picture_upload'] = array(
    '#type' => 'file',
    '#title' => t('Upload picture'),
    '#size' => 48,
869
    '#description' => t('Your virtual face or picture. Pictures larger than @dimensions pixels will be scaled down.', array('@dimensions' => variable_get('user_picture_dimensions', '85x85'))) . ' ' . filter_xss_admin(variable_get('user_picture_guidelines', '')),
870
871
  );
  $form['#validate'][] = 'user_validate_picture';
872
873

  if (module_exists('language') && language_multilingual()) {
874
    $languages = language_list();
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934

    // If the user is being created, we set the user language to the page language.
    $user_preferred_language = $register ? $language_interface : user_preferred_language($account);

    $names = array();
    foreach ($languages as $langcode => $item) {
      $names[$langcode] = $item->name;
    }
    // Is default the interface language?
    $interface_language_is_default = language_negotiation_method_get_first(LANGUAGE_TYPE_INTERFACE) != LANGUAGE_NEGOTIATION_DEFAULT;
    $form['language'] = array(
      '#type' => 'fieldset',
      '#title' => t('Language settings'),
      // Display language selector when either creating a user on the admin
      // interface or editing a user account.
      '#access' => !$register || user_access('administer users'),
    );
    $form['language']['preferred_langcode'] = array(
      '#type' => (count($names) <= 5 ? 'radios' : 'select'),
      '#title' => t('Language'),
      '#default_value' => $user_preferred_language->langcode,
      '#options' => $names,
      '#description' => $interface_language_is_default ? t("This account's preferred language for e-mails and site presentation.") : t("This account's preferred language for e-mails."),
    );
  }
  else {
    $form['language'] = array(
      '#type' => 'container',
    );
    $form['language']['preferred_langcode'] = array(
      '#type' => 'value',
      '#value' => language_default()->langcode,
    );
  }

  // User entities contain both a langcode property (for identifying the
  // language of the entity data) and a preferred_langcode property (see above).
  // Rather than provide a UI forcing the user to choose both separately,
  // assume that the user profile data is in the user's preferred language. This
  // element provides that synchronization. For use-cases where this
  // synchronization is not desired, a module can alter or remove this element.
  $form['language']['langcode'] = array(
    '#type' => 'value',
    '#value_callback' => '_user_language_selector_langcode_value',
    // For the synchronization to work, this element must have a larger weight
    // than the preferred_langcode element. Set a large weight here in case
    // a module alters the weight of the other element.
    '#weight' => 100,
  );
}

/**
 * Sets the value of the user register and profile forms' langcode element.
 */
function _user_language_selector_langcode_value($element, $input, &$form_state) {
  // Only add to the description if the form element have a description.
  if (isset($form_state['complete_form']['language']['preferred_langcode']['#description'])) {
    $form_state['complete_form']['language']['preferred_langcode']['#description'] .= ' ' . t("This is also assumed to be the primary language of this account's profile information.");
  }
  return $form_state['values']['preferred_langcode'];
935
936
}

937
938
/**
 * Form validation handler for the current password on the user_account_form().
939
 *
940
 * @see user_account_form()
941
942
943
944
945
946
947
948
 */
function user_validate_current_pass(&$form, &$form_state) {
  $account = $form['#user'];
  foreach ($form_state['values']['current_pass_required_values'] as $key => $name) {
    // This validation only works for required textfields (like mail) or
    // form values like password_confirm that have their own validation
    // that prevent them from being empty if they are changed.
    if ((strlen(trim($form_state['values'][$key])) > 0) && ($form_state['values'][$key] != $account->$key)) {
949
      require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'core/includes/password.inc');
950
      $current_pass_failed = empty($form_state['values']['current_pass']) || !user_check_password($form_state['values']['current_pass'], $account);
951
952
953
954
955
956
957
958
959
960
      if ($current_pass_failed) {
        form_set_error('current_pass', t("Your current password is missing or incorrect; it's required to change the %name.", array('%name' => $name)));
        form_set_error($key);
      }
      // We only need to check the password once.
      break;
    }
  }
}

961
962
/**
 * Form validation handler for user_account_form().
963
 *
964
 * @see user_account_form()
965
966
 */
function user_account_form_validate($form, &$form_state) {
967
968
969
970
971
  $account = $form['#user'];
  // Validate new or changing username.
  if (isset($form_state['values']['name'])) {
    if ($error = user_validate_name($form_state['values']['name'])) {
      form_set_error('name', $error);
972
    }
973
974
975
976
977
978
979
980
981
982
983
984
985
986
    // Cast the user ID as an integer. It might have been set to NULL, which
    // could lead to unexpected results.
    else {
      $name_taken = (bool) db_select('users')
        ->fields('users', array('uid'))
        ->condition('uid', (int) $account->uid, '<>')
        ->condition('name', db_like($form_state['values']['name']), 'LIKE')
        ->range(0, 1)
        ->execute()
        ->fetchField();

      if ($name_taken) {
        form_set_error('name', t('The name %name is already taken.', array('%name' => $form_state['values']['name'])));
      }
987
988
    }
  }
989

990
  $mail = $form_state['values']['mail'];
991

992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
  if (!empty($mail)) {
    $mail_taken = (bool) db_select('users')
      ->fields('users', array('uid'))
      ->condition('uid', (int) $account->uid, '<>')
      ->condition('mail', db_like($mail), 'LIKE')
      ->range(0, 1)
      ->execute()
      ->fetchField();

    if ($mail_taken) {
      // Format error message dependent on whether the user is logged in or not.
      if ($GLOBALS['user']->uid) {
        form_set_error('mail', t('The e-mail address %email is already taken.', array('%email' => $mail)));
      }
      else {
        form_set_error('mail', t('The e-mail address %email is already registered. <a href="@password">Have you forgotten your password?</a>', array('%email' => $mail, '@password' => url('user/password'))));
      }
1009
    }
1010
  }
1011

1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
  // Make sure the signature isn't longer than the size of the database field.
  // Signatures are disabled by default, so make sure it exists first.
  if (isset($form_state['values']['signature'])) {
    // Move text format for user signature into 'signature_format'.
    $form_state['values']['signature_format'] = $form_state['values']['signature']['format'];
    // Move text value for user signature into 'signature'.
    $form_state['values']['signature'] = $form_state['values']['signature']['value'];

    $user_schema = drupal_get_schema('users');
    if (drupal_strlen($form_state['values']['signature']) > $user_schema['fields']['signature']['length']) {
      form_set_error('signature', t('The signature is too long: it must be %max characters or less.', array('%max' => $user_schema['fields']['signature']['length'])));
1023
    }
1024
  }
1025
}
1026

1027
function user_login_block($form) {
1028
  $form['#action'] = url(current_path(), array('query' => drupal_get_destination(), 'external' => FALSE));
1029
1030
1031
  $form['#id'] = 'user-login-form';
  $form['#validate'] = user_login_default_validators();
  $form['#submit'][] = 'user_login_submit';
1032
1033
  $form['name'] = array('#type' => 'textfield',
    '#title' => t('Username'),
1034
    '#maxlength' => USERNAME_MAX_LENGTH,
1035
1036
1037
1038
1039
    '#size' => 15,
    '#required' => TRUE,
  );
  $form['pass'] = array('#type' => 'password',
    '#title' => t('Password'),
1040
    '#maxlength' => 60,
1041
1042
1043
    '#size' => 15