$value) {
if ($key == 'pass') {
$query .= "u.$key = '". md5($value) ."' AND ";
}
else {
$query .= "LOWER(u.$key) = '". strtolower(check_query($value)) ."' AND ";
}
}
$result = db_query_range("SELECT u.* FROM {users} u WHERE $query u.status < 3", 0, 1);
$user = db_fetch_object($result);
$user = drupal_unpack($user);
user_module_invoke('load', $array, $user);
$user->roles = array();
$result = db_query('SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $user->uid);
while ($role = db_fetch_object($result)) {
$user->roles[$role->rid] = $role->name;
}
return $user;
}
function user_save($account, $array = array(), $category = 'account') {
// Dynamically compose a SQL query:
$user_fields = user_fields();
if ($account->uid) {
user_module_invoke('update', $array, $account, $category);
$data = unserialize(db_result(db_query('SELECT data FROM {users} WHERE uid = %d', $account->uid)));
foreach ($array as $key => $value) {
if ($key == 'pass') {
$query .= "$key = '%s', ";
$v[] = md5($value);
}
else if (substr($key, 0, 4) !== 'auth') {
if (in_array($key, $user_fields)) {
// escape '%'s:
$value = str_replace('%', '%%', $value);
$query .= "$key = '%s', ";
$v[] = $value;
}
else {
$data[$key] = $value;
}
}
}
$query .= "data = '%s', ";
$v[] = serialize($data);
db_query("UPDATE {users} SET $query changed = %d WHERE uid = %d", array_merge($v, array(time(), $account->uid)));
// reload user roles if provided
if (is_array($array['roles'])) {
db_query('DELETE FROM {users_roles} WHERE uid = %d', $account->uid);
foreach ($array['roles'] as $rid) {
db_query('INSERT INTO {users_roles} (uid, rid) VALUES (%d, %d)', $account->uid, $rid);
}
}
$user = user_load(array('uid' => $account->uid));
}
else {
$array['created'] = time();
$array['changed'] = time();
$array['uid'] = db_next_id('{users}_uid');
foreach ($array as $key => $value) {
if ($key == 'pass') {
$fields[] = check_query($key);
$values[] = md5($value);
$s[] = "'%s'";
}
else if (substr($key, 0, 4) !== 'auth') {
if (in_array($key, $user_fields)) {
$fields[] = check_query($key);
$values[] = $value;
$s[] = "'%s'";
}
else {
$data[$key] = $value;
}
}
}
$fields[] = 'data';
$values[] = serialize($data);
$s[] = "'%s'";
db_query('INSERT INTO {users} ('. implode(', ', $fields) .') VALUES ('. implode(', ', $s) .')', $values);
// Reload user roles (delete just to be safe).
db_query('DELETE FROM {users_roles} WHERE uid = %d', $array['uid']);
foreach ($array['roles'] as $rid) {
db_query('INSERT INTO {users_roles} (uid, rid) VALUES (%d, %d)', $array['uid'], $rid);
}
$user = user_load(array('name' => $array['name']));
module_invoke_all('user', 'insert', $array, $user, $category);
}
foreach ($array as $key => $value) {
if (substr($key, 0, 4) == 'auth') {
$authmaps[$key] = $value;
}
}
if ($authmaps) {
user_set_authmaps($user, $authmaps);
}
return $user;
}
/**
* Verify the syntax of the given name.
*/
function user_validate_name($name) {
if (!$name) return t('You must enter a username.');
if (substr($name, 0, 1) == ' ') return t('The username cannot begin with a space.');
if (substr($name, -1) == ' ') return t('The username cannot end with a space.');
if (ereg(' ', $name)) return t('The username cannot contain multiple spaces in a row.');
if (ereg('[^ [:alnum:]@_.-]', $name)) return t('The username contains an illegal character.');
if (ereg('@', $name) && !eregi('@([0-9a-z](-?[0-9a-z])*.)+[a-z]{2}([zmuvtg]|fo|me)?$', $name)) return t('The username is not a valid authentication ID.');
if (strlen($name) > 56) return t('The username "%name" is too long: it must be less than 56 characters.', array('%name' => $name));
}
function user_validate_mail($mail) {
if (!$mail) return t('You must enter an e-mail address.');
if (!valid_email_address($mail)) {
return t('The e-mail address "%mail" is not valid.', array('%mail' => $mail));
}
}
function user_validate_picture($file, &$edit, $user) {
// Initialize the picture:
$edit['picture'] = $user->picture;
// Check that uploaded file is an image, with a maximum file size
// and maximum height/width.
$extension = strtolower(strrchr($file->name, '.'));
$size = getimagesize($file->path);
list($maxwidth, $maxheight) = explode('x', variable_get('user_picture_dimensions', '85x85'));
if ((!in_array($size[2], array(1, 2, 3))) || (!in_array($extension, array('.gif', '.jpg', '.png', '.jpeg')))) {
form_set_error('picture', t('The uploaded file was not an image.'));
}
else if ($file->size > (variable_get('user_picture_file_size', '30') * 1000)) {
form_set_error('picture', t('The uploaded image is too large; the maximum file size is %a kB.', array('%a' => variable_get('user_picture_file_size', '30'))));
}
else if ($size[0] > $maxwidth || $size[1] > $maxheight) {
form_set_error('picture', t('The uploaded image is too large; the maximum dimensions are %a pixels.', array('%a' => variable_get('user_picture_dimensions', '85x85'))));
}
else if ($file = file_save_upload('picture', variable_get('user_picture_path', 'pictures') . FILE_SEPARATOR .'picture-'. $user->uid . $extension, 1)) {
$edit['picture'] = $file->path;
}
else {
form_set_error('picture', t('Failed to upload the picture image; the "%directory" directory doesn\'t exist.', array('%directory' => variable_get('user_picture_path', 'pictures'))));
}
}
function user_validate_authmap($account, $authname, $module) {
$result = db_query("SELECT COUNT(*) from {authmap} WHERE uid != %d AND authname = '%s'", $account->uid, $authname);
if (db_result($result) > 0) {
$name = module_invoke($module, 'info', 'name');
return t('The %u ID %s is already taken.', array('%u' => $name, '%s' => "$authname"));
}
}
/**
* Generate a random alphanumeric password.
*/
function user_password($length = 10) {
// This variable contains the list of allowable characters for the
// password. Note that the number 0 and the letter 'O' have been
// removed to avoid confusion between the two. The same is true
// of 'I' and 1.
$allowable_characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';
// We see how many characters are in the allowable list:
$len = strlen($allowable_characters);
// Seed the random number generator with the microtime stamp.
mt_srand((double)microtime() * 1000000);
// Declare the password as a blank string.
$pass = '';
// Loop the number of times specified by $length.
for ($i = 0; $i < $length; $i++) {
// Each iteration, pick a random character from the
// allowable string and append it to the password:
$pass .= $allowable_characters[mt_rand(0, $len - 1)];
}
return $pass;
}
/**
* Determine whether the user has a given privilege.
*
* @param $string
* The permission, such as "administer nodes", being checked for.
*
* @return
* TRUE iff the current user has the requested permission.
*
* All permission checks in Drupal should go through this function. This
* way, we guarantee consistent behavior, and ensure that the superuser
* can perform all actions.
*/
function user_access($string) {
global $user;
static $perm = 0;
// User #1 has all priveleges:
if ($user->uid == 1) {
return 1;
}
// To reduce the number of SQL queries, we cache the user's permissions
// in a static variable.
if ($perm === 0) {
$result = db_query('SELECT DISTINCT(p.perm) FROM {role} r INNER JOIN {permission} p ON p.rid = r.rid INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $user->uid);
while ($row = db_fetch_object($result)) {
$perm .= "$row->perm, ";
}
}
return strstr($perm, "$string, ");
}
/**
* Send an e-mail message.
*/
function user_mail($mail, $subject, $message, $header) {
if (variable_get('smtp_library', '') && file_exists(variable_get('smtp_library', ''))) {
include_once variable_get('smtp_library', '');
return user_mail_wrapper($mail, $subject, $message, $header);
}
else {
/*
** Note: if you are having problems with sending mail, or mails look wrong
** when they are recieved you may have to modify the str_replace to suit
** your systems.
** - \r\n will work under dos and windows.
** - \n will work for linux, unix and BSDs.
** - \r will work for macs.
**
** According to RFC 2646, it's quite rude to not wrap your e-mails:
**
** "The Text/Plain media type is the lowest common denominator of
** Internet email, with lines of no more than 997 characters (by
** convention usually no more than 80), and where the CRLF sequence
** represents a line break [MIME-IMT]."
**
** CRLF === \r\n
**
** http://www.rfc-editor.org/rfc/rfc2646.txt
**
*/
return mail(
$mail,
user_mail_encode($subject),
str_replace("\r", '', $message),
"MIME-Version: 1.0\nContent-Type: text/plain; charset=UTF-8; format=flowed\nContent-transfer-encoding: 8Bit\n" . $header
);
}
}
function user_mail_encode($string, $charset = 'UTF-8') {
/*
** Used to encodes mail headers that contain non US- ASCII
** characters.
** http://www.rfc-editor.org/rfc/rfc2047.txt
**
** Notes:
** - Only encode strings that contain non-ASCII characters.
** - The chunks come in groupings of 4 bytes when using base64
** encoded.
** - trim() is used to ensure that no extra spacing is added by
** chunk_split() or preg_replace().
** - Using \n as the chunk separator may cause problems on some
** systems and may have to be changed to \r\n or \r.
*/
if (!preg_match('/^[\x20-\x7E]*$/', $string)) {
$chunk_size = 75 - 7 - strlen($charset);
$chunk_size -= $chunk_size % 4;
$string = trim(chunk_split(base64_encode($string), $chunk_size, "\n"));
$string = trim(preg_replace('/^(.*)$/m', " =?$charset?B?\\1?=", $string));
}
return $string;
}
function user_deny($type, $mask) {
$allow = db_fetch_object(db_query("SELECT * FROM {access} WHERE status = 1 AND type = '%s' AND LOWER('%s') LIKE LOWER(mask)", $type, $mask));
$deny = db_fetch_object(db_query("SELECT * FROM {access} WHERE status = 0 AND type = '%s' AND LOWER('%s') LIKE LOWER(mask)", $type, $mask));
return $deny && !$allow;
}
function user_fields() {
static $fields;
if (!$fields) {
$result = db_query('SELECT * FROM {users} WHERE uid = 1');
if (db_num_rows($result)) {
$fields = array_keys(db_fetch_array($result));
}
else {
// Make sure we return the default fields at least
$fields = array('uid', 'name', 'pass', 'mail', 'picture', 'mode', 'sort', 'threshold', 'theme', 'signature', 'created', 'changed', 'status', 'timezone', 'language', 'init', 'data');
}
}
return $fields;
}
/**
* Implementation of hook_perm().
*/
function user_perm() {
return array('administer users');
}
/**
* Implementation of hook_file_download().
*
* Ensure that user pictures (avatars) are always downloadable.
*/
function user_file_download($file) {
if (strpos($file, variable_get('user_picture_path', 'pictures') . FILE_SEPARATOR . 'picture-') === 0) {
list($width, $height, $type, $attr) = getimagesize(file_create_path($file));
$types = array(
IMAGETYPE_GIF => 'image/gif',
IMAGETYPE_JPEG => 'image/jpeg',
IMAGETYPE_PNG => 'image/png',
IMAGETYPE_SWF => 'application/x-shockwave-flash',
IMAGETYPE_PSD => 'image/psd',
IMAGETYPE_BMP => 'image/bmp',
IMAGETYPE_TIFF_II => 'image/tiff',
IMAGETYPE_TIFF_MM => 'image/tiff',
IMAGETYPE_JPC => 'application/octet-stream',
IMAGETYPE_JP2 => 'image/jp2',
IMAGETYPE_JPX => 'application/octet-stream',
IMAGETYPE_JB2 => 'application/octet-stream',
IMAGETYPE_SWC => 'application/x-shockwave-flash',
IMAGETYPE_IFF => 'image/iff',
IMAGETYPE_WBMP => 'image/vnd.wap.wbmp',
IMAGETYPE_XBM => 'image/xbm'
);
return array('Content-type: '. $types[$type]);
}
}
/**
* Implementation of hook_search().
*/
function user_search($keys) {
$find = array();
// Replace wildcards with MySQL/PostgreSQL wildcards.
$keys = str_replace('*', '%', $keys);
$result = db_query_range("SELECT * FROM {users} WHERE LOWER(name) LIKE '%%%s%%'", strtolower($keys), 0, 20);
while ($account = db_fetch_object($result)) {
$find[] = array('title' => $account->name, 'link' => url("user/$account->uid/view"), 'user' => $account->name);
}
return array(t('Matching users'), $find);
}
/**
* Implementation of hook_user().
*/
function user_user($type, &$edit, &$user, $category = NULL) {
if ($type == 'view') {
return array(t('History') => form_item(t('Member for'), format_interval(time() - $user->created)));
}
if ($type == 'form' && $category == 'account') {
return user_edit_form(arg(1), $edit);
}
if ($type == 'validate' && $category == 'account') {
return user_edit_validate(arg(1), $edit);
}
if ($type == 'categories') {
return array(array('name' => 'account', 'title' => t('account settings'), 'weight' => 1));
}
}
/**
* Implementation of hook_block().
*/
function user_block($op = 'list', $delta = 0) {
global $user;
if ($op == 'list') {
$blocks[0]['info'] = t('User login');
$blocks[1]['info'] = t('Navigation');
$blocks[2]['info'] = t('Who\'s new');
$blocks[3]['info'] = t('Who\'s online');
return $blocks;
}
else {
$block = array();
switch ($delta) {
case 0:
if (!$user->uid) {
// For usability's sake, avoid showing two login forms on one page.
if (arg(0) == 'user' && arg(1) != 'view') {
return;
}
$edit = $_POST['edit'];
$output = "
\n";
// Save the referer. We record where the user came from such
// that we can redirect him after having completed the login form.
if (empty($edit)) {
$edit['destination'] = $_GET['q'];
}
// NOTE: special care needs to be taken because on pages with forms,
// such as node and comment submission pages, the $edit variable
// might already be set.
$output .= form_hidden('destination', $edit['destination']);
$output .= form_textfield(t('Username'), 'name', $edit['name'], 15, 64);
$output .= form_password(t('Password'), 'pass', $pass, 15, 64);
$output .= form_submit(t('Log in'));
$output .= "
\n";
$output = form($output, 'post', url('user/login'));
if (variable_get('user_register', 1)) {
$items[] = l(t('Create new account'), 'user/register', array('title' => t('Create a new user account.')));
}
$items[] = l(t('Request new password'), 'user/password', array('title' => t('Request new password via e-mail.')));
$output .= theme('item_list', $items);
$block['subject'] = t('User login');
$block['content'] = $output;
}
return $block;
case 1:
if ($menu = theme('menu_tree')) {
$block['subject'] = $user->uid ? $user->name : t('Navigation');
$block['content'] = '
'. $menu .'
';
}
return $block;
case 2:
if (user_access('access content')) {
$result = db_query_range('SELECT uid, name FROM {users} WHERE status != 0 ORDER BY uid DESC', 0, 5);
while ($account = db_fetch_object($result)) {
$items[] = format_name($account);
}
$output = theme('user_list', $items);
$block['subject'] = t('Who\'s new');
$block['content'] = $output;
return $block;
}
case 3:
if (user_access('access content')) {
// Count users with activity in the past defined period.
$time_period = variable_get('user_block_seconds_online', 2700);
// Perform database queries to gather online user lists.
$guests = db_fetch_object(db_query('SELECT COUNT(DISTINCT(sid)) AS count FROM {sessions} WHERE timestamp >= %d AND uid = 0', time() - $time_period));
$users = db_query('SELECT DISTINCT(uid), MAX(timestamp) AS max_timestamp FROM {sessions} WHERE timestamp >= %d AND uid != 0 GROUP BY uid ORDER BY max_timestamp DESC', time() - $time_period );
$total_users = db_num_rows($users);
// Format the output with proper grammar.
if ($total_users == 1 && $guests->count == 1) {
$output = t('There is currently %members and %visitors online.', array('%members' => format_plural($total_users, '1 user', '%count users'), '%visitors' => format_plural($guests->count, '1 guest', '%count guests')));
}
else {
$output = t('There are currently %members and %visitors online.', array('%members' => format_plural($total_users, '1 user', '%count users'), '%visitors' => format_plural($guests->count, '1 guest', '%count guests')));
}
// Display a list of currently online users.
$max_users = variable_get('user_block_max_list_count', 10);
if ($max_users) {
$items = array();
while ($max_users-- && $uid = db_fetch_object($users)) {
$items[] = format_name(user_load(array('uid' => $uid->uid)));
}
if ($items) {
if (db_fetch_object($users)) {
$items[] = '...';
}
$output .= theme('item_list', $items, t('Online users:'));
}
}
$block['subject'] = t('Who\'s online');
$block['content'] = $output;
}
return $block;
}
}
}
function theme_user_picture($account) {
if (variable_get('user_pictures', 0)) {
if ($account->picture && file_exists($account->picture)) {
$picture = file_create_url($account->picture);
}
else if (variable_get('user_picture_default', '')) {
$picture = variable_get('user_picture_default', '');
}
if ($picture) {
$alt = t('%user\'s picture', array('%user' => $account->name ? $account->name : t(variable_get('anonymous', 'Anonymous'))));
$picture = theme('image', $picture, $alt, $alt);
if ($account->uid) {
$picture = l($picture, "user/$account->uid", array('title' => t('View user profile.')));
}
return "
\n";
return $output;
}
function theme_user_list($items, $title = NULL) {
return theme('item_list', $items, $title);
}
/**
* Implementation of hook_menu().
*/
function user_menu() {
global $user;
$items = array();
$access = user_access('administer users');
if (arg(0) == 'user' && is_numeric(arg(1))) {
$items[] = array('path' => 'user/'. arg(1), 'title' => t('user'),
'type' => MENU_CALLBACK, 'callback' => 'user_page', 'access' => TRUE);
$items[] = array('path' => 'user/'. arg(1) .'/view', 'title' => t('view'),
'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
$items[] = array('path' => 'user/'. arg(1) .'/edit', 'title' => t('edit'),
'callback' => 'user_edit', 'access' => $access || $user->uid == arg(1),
'type' => MENU_LOCAL_TASK);
if (arg(2) == 'edit') {
if (($categories = _user_categories()) && (count($categories) > 1)) {
foreach ($categories as $key => $category) {
$items[] = array('path' => 'user/'. arg(1) .'/edit/'. $category['name'], 'title' => $category['title'],
'type' => $category['name'] == 'account' ? MENU_DEFAULT_LOCAL_TASK : MENU_LOCAL_TASK,
'weight' => $category['weight']);
}
}
}
}
if ($user->uid) {
$items[] = array('path' => "user/$user->uid", 'title' => t('my account'),
'callback' => 'user_page', 'access' => TRUE);
$items[] = array('path' => 'logout', 'title' => t('log out'),
'access' => TRUE,
'callback' => 'user_logout',
'weight' => 10);
}
else {
$items[] = array('path' => 'logout', 'title' => t('log out'),
'callback' => 'user_logout', 'access' => FALSE);
}
$items[] = array('path' => 'user', 'title' => t('user'),
'callback' => 'user_page', 'access' => TRUE,
'type' => MENU_CALLBACK);
$items[] = array('path' => 'user/login', 'title' => t('log in'),
'callback' => 'user_page', 'access' => TRUE, 'type' => MENU_CALLBACK);
$items[] = array('path' => 'user/register', 'title' => t('register'),
'callback' => 'user_page', 'access' => TRUE, 'type' => MENU_CALLBACK);
$items[] = array('path' => 'user/password', 'title' => t('request new password'),
'callback' => 'user_page', 'access' => TRUE, 'type' => MENU_CALLBACK);
$items[] = array('path' => 'admin/user', 'title' => t('users'),
'callback' => 'user_admin', 'access' => $access);
$items[] = array('path' => 'admin/user/list', 'title' => t('list'),
'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
$items[] = array('path' => 'admin/user/create', 'title' => t('add'),
'callback' => 'user_admin', 'access' => $access,
'type' => MENU_LOCAL_TASK);
$items[] = array('path' => 'admin/user/configure', 'title' => t('configure'),
'callback' => 'user_configure', 'access' => $access,
'type' => MENU_LOCAL_TASK);
$items[] = array('path' => 'admin/user/configure/settings', 'title' => t('settings'),
'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
$items[] = array('path' => 'admin/user/configure/access', 'title' => t('access rules'),
'callback' => 'user_configure', 'access' => $access,
'type' => MENU_LOCAL_TASK);
$items[] = array('path' => 'admin/user/configure/access/mail', 'title' => t('e-mail rules'),
'callback' => 'user_configure', 'access' => $access,
'type' => MENU_LOCAL_TASK);
$items[] = array('path' => 'admin/user/configure/access/user', 'title' => t('name rules'),
'callback' => 'user_configure', 'access' => $access,
'type' => MENU_LOCAL_TASK);
$items[] = array('path' => 'admin/user/configure/role', 'title' => t('roles'),
'callback' => 'user_configure', 'access' => $access,
'type' => MENU_LOCAL_TASK);
$items[] = array('path' => 'admin/user/configure/permission', 'title' => t('permissions'),
'callback' => 'user_configure', 'access' => $access,
'type' => MENU_LOCAL_TASK);
if (module_exist('search')) {
$items[] = array('path' => 'admin/user/search', 'title' => t('search'),
'callback' => 'user_admin', 'access' => $access,
'type' => MENU_LOCAL_TASK);
}
return $items;
}
/**
* Called by authentication modules in order to edit/view their authmap information.
*/
function user_get_authname($account, $module) {
$result = db_query("SELECT authname FROM {authmap} WHERE uid = %d AND module = '%s'", $account->uid, $module);
return db_result($result);
}
/**
* Accepts an user object, $account, or a DA name and returns an associative
* array of modules and DA names. Called at external login.
*/
function user_get_authmaps($authname = NULL) {
$result = db_query("SELECT authname, module FROM {authmap} WHERE authname = '%s'", $authname);
if (db_num_rows($result) > 0) {
while ($authmap = db_fetch_object($result)) {
$authmaps[$authmap->module] = $authmap->authname;
}
return $authmaps;
}
else {
return 0;
}
}
function user_set_authmaps($account, $authmaps) {
foreach ($authmaps as $key => $value) {
$module = explode('_', $key, 2);
if ($value) {
db_query("UPDATE {authmap} SET authname = '%s' WHERE uid = %d AND module = '%s'", $value, $account->uid, $module['1']);
if (!db_affected_rows()) {
db_query("INSERT INTO {authmap} (authname, uid, module) VALUES ('%s', %d, '%s')", $value, $account->uid, $module[1]);
}
}
else {
db_query("DELETE FROM {authmap} WHERE uid = %d AND module = '%s'", $account->uid, $module['1']);
}
}
}
function user_auth_help_links() {
$links = array();
foreach (module_list() as $module) {
if (module_hook($module, 'auth')) {
$links[] = l(module_invoke($module, 'info', 'name'), "user/help#$module");
}
}
return $links;
}
/*** User features *********************************************************/
function user_login($edit = array(), $msg = '') {
global $user, $base_url;
// If we are already logged on, go to the user page instead.
if ($user->uid) {
drupal_goto('user');
}
if (user_deny('user', $edit['name'])) {
$error = t('The name "%s" has been denied access.', array('%s' => $edit['name']));
}
else if ($edit['name'] && $edit['pass']) {
// Try to log in the user locally:
if (!$user->uid) {
$name = $edit['name'];
$pass = $edit['pass'];
$user = user_load(array('name' => $name, 'pass' => $pass, 'status' => 1));
}
// Strip name and server from ID:
if ($server = strrchr($edit['name'], '@')) {
$name = substr($edit['name'], 0, strlen($edit['name']) - strlen($server));
$server = substr($server, 1);
$pass = $edit['pass'];
}
// When possible, determine corresponding external auth source. Invoke
// source, and log in user if successful:
if (!$user->uid && $server && $result = user_get_authmaps("$name@$server")) {
if (module_invoke(key($result), 'auth', $name, $pass, $server)) {
$user = user_external_load("$name@$server");
watchdog('user', t('external load by %user using module "%module".', array('%user' => $name .'@'. $server, '%module' => key($result))));
}
else {
$error = t('Invalid password for %s.', array('%s' => "$name@$server"));
}
}
// Try each external authentication source in series. Register user if
// successful.
else if (!$user->uid && $server) {
foreach (module_list() as $module) {
if (module_hook($module, 'auth')) {
if (module_invoke($module, 'auth', $name, $pass, $server)) {
if (variable_get('user_register', 1) == 1) {
$account = user_load(array('name' => "$name@$server"));
if (!$account->uid) { // Register this new user.
$user = user_save('', array('name' => "$name@$server", 'pass' => user_password(), 'init' => "$name@$server", 'status' => 1, "authname_$module" => "$name@$server", 'roles' => array(_user_authenticated_id())));
watchdog('user', t('new external user: %user using module "%module".', array('%user' => $name .'@'. $server, '%module' => $module)), l(t('edit'), 'user/'. $user->uid .'/edit'));
break;
}
}
}
}
}
}
if ($user->uid) {
watchdog('user', t('session opened for "%user".', array('%user' => $user->name)));
// Update the user table timestamp noting user has logged in.
db_query("UPDATE {users} SET changed = '%d' WHERE uid = '%s'", time(), $user->uid);
user_module_invoke('login', $edit, $user);
// If the user wants to be remembered, set the proper cookie such
// that the session won't expire.
$path = preg_replace("/.+\/\/[^\/]+(.*)/", "\$1/", $base_url);
setcookie(session_name(), session_id(), FALSE, $path);
// Redirect the user to the page he logged on from.
drupal_goto($edit['destination']);
}
else {
if (!$error) {
$error = t('Sorry. Unrecognized username or password.') .' '. l(t('Have you forgotten your password?'), 'user/password');
}
watchdog('user', t('login attempt failed for %user: "%error"', array('%user' => $server ? ($name .'@'. $server) : $name, '%error' => $error)));
}
}
// Display error message (if any):
if ($error) {
drupal_set_message($error, 'error');
}
// Save the referrer. We record where the user came from such that we
// can redirect him after having completed the login form.
if (empty($edit)) {
$edit['destination'] = $_GET['q'];
}
$output .= form_hidden('destination', $edit['destination']);
// Display login form:
if ($msg) {
$output .= "
$msg
";
}
if (count(user_auth_help_links()) > 0) {
$output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64, t('Enter your %s username, or an ID from one of our affiliates: %a.', array('%s' => variable_get('site_name', 'local'), '%a' => implode(', ', user_auth_help_links()))));
}
else {
$output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64, t('Enter your %s username.', array('%s' => variable_get('site_name', 'local'))));
}
$output .= form_password(t('Password'), 'pass', $pass, 30, 64, t('Enter the password that accompanies your username.'));
$output .= form_submit(t('Log in'));
$items[] = l(t('Request new password'), 'user/password');
if (variable_get('user_register', 1)) {
$items[] = l(t('Create new account'), 'user/register');
}
$output .= theme('item_list', $items);
$output = form_group(t('User login'), $output);
return form($output, 'post', url('user/login'));
}
function _user_authenticated_id() {
return db_result(db_query("SELECT rid FROM {role} WHERE name = 'authenticated user'"));
}
/**
* Menu callback; logs the current user out, and redirects to the home page.
*/
function user_logout() {
global $user;
if ($user->uid) {
watchdog('user', t('session closed for %user.', array('%user' => $user->name)));
// Destroy the current session:
session_destroy();
module_invoke_all('user', 'logout', NULL, $user);
unset($user);
}
drupal_goto();
}
function user_pass($edit = array()) {
global $base_url;
if ($edit['name']) {
$account = user_load(array('name' => $edit['name'], 'status' => 1));
if (!$account) form_set_error('name', t('Sorry. The username "%s" is not recognized.', array('%s' => $edit['name'])));
}
else if ($edit['mail']) {
$account = user_load(array('mail' => $edit['mail'], 'status' => 1));
if (!$account) form_set_error('name', t('Sorry. The e-mail address "%s" is not recognized.', array('%s' => $edit['mail'])));
}
if ($account) {
$from = variable_get('site_mail', ini_get('sendmail_from'));
$pass = user_password();
// Save new password:
user_save($account, array_merge(object2array($account), array('pass' => $pass)));
// Mail new password:
$variables = array('%username' => $account->name, '%site' => variable_get('site_name', 'drupal'), '%password' => $pass, '%uri' => $base_url, '%uri_brief' => substr($base_url, strlen('http://')), '%mailto' => $account->mail, '%date' => format_date(time()), '%login_uri' => url('user/login', NULL, NULL, TRUE), '%edit_uri' => url('user/edit', NULL, NULL, TRUE));
$subject = _user_mail_text('pass_subject', $variables);
$body = _user_mail_text('pass_body', $variables);
$headers = "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from";
$mail_success = user_mail($account->mail, $subject, $body, $headers);
if ($mail_success) {
watchdog('user', t('password mailed to %user at %address.', array('%user' => $account->name, '%address' => $account->mail)));
return t('Your password and further instructions have been sent to your e-mail address.');
}
else {
watchdog('error', t('error mailing password to %user at %address.', array('%user' => $account->name, '%address' => $account->mail)));
return t('Unable to send mail. Please contact the site admin.');
}
}
else {
// Display form:
$output .= '
'. t('Enter your username or your e-mail address.') .'
';
$output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64);
$output .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 64);
$output .= form_submit(t('E-mail new password'));
$items[] = l(t('Log in'), 'user/login');
if (variable_get('user_register', 1)) {
$items[] = l(t('Create new account'), 'user/register');
}
$output .= theme('item_list', $items);
$output = form_group(t('Request new password'), $output);
return form($output, 'post', url('user/password'));
}
}
function user_register($edit = array()) {
global $user, $base_url;
// If we are already logged on, go to the user page instead.
if ($user->uid) {
drupal_goto('user/edit');
}
if ($edit) {
user_module_invoke('validate', $edit, $edit, 'account');
if (!form_get_errors()) {
$from = variable_get('site_mail', ini_get('sendmail_from'));
$pass = user_password();
// TODO: Is this necessary? Won't session_write() replicate this?
unset($edit['session']);
$account = user_save('', array('name' => $edit['name'], 'pass' => $pass, 'init' => $edit['mail'], 'mail' => $edit['mail'], 'roles' => array(_user_authenticated_id()), 'status' => (variable_get('user_register', 1) == 1 ? 1 : 0)));
watchdog('user', t('new user: "%user" <%address>.', array('%user' => $edit['name'], '%address' => $edit['mail'])), l(t('edit'), 'user/'. $account->uid .'/edit'));
$variables = array('%username' => $edit['name'], '%site' => variable_get('site_name', 'drupal'), '%password' => $pass, '%uri' => $base_url, '%uri_brief' => substr($base_url, strlen('http://')), '%mailto' => $edit['mail'], '%date' => format_date(time()), '%login_uri' => url('user/login', NULL, NULL, TRUE), '%edit_uri' => url('user/edit', NULL, NULL, TRUE));
// The first user may login immediately, and receives a customized welcome e-mail.
if ($account->uid == 1) {
user_mail($edit['mail'], t('drupal user account details for %s', array('%s' => $edit['name'])), strtr(t("%username,\n\nYou may now login to %uri using the following username and password:\n\n username: %username\n password: %password\n\n%edit_uri\n\n--drupal"), $variables), "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
// This should not be t()'ed. No point as its only shown once in the sites lifetime, and it would be bad to store the password.
$output .= "
Welcome to Drupal. You are user #1, which gives you full and immediate access. All future registrants will receive their passwords via e-mail, so please configure your e-mail settings using the Administration pages.
Your password is $pass. You may change your password on the next page.
Please login below.
";
$output .= form_hidden('destination', 'user/edit');
$output .= form_hidden('name', $account->name);
$output .= form_hidden('pass', $pass);
$output .= form_submit(t('Log in'));
return form($output);
}
else {
if ($account->status) {
// Create new user account, no administrator approval required.
$subject = _user_mail_text('welcome_subject', $variables);
$body = _user_mail_text('welcome_body', $variables);
user_mail($edit['mail'], $subject, $body, "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
return t('Your password and further instructions have been sent to your e-mail address.');
}
else {
// Create new user account, administrator approval required.
$subject = _user_mail_text('approval_subject', $variables);
$body = _user_mail_text('approval_body', $variables);
user_mail($edit['mail'], $subject, $body, "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
user_mail(variable_get('site_mail', ini_get('sendmail_from')), $subject, t("%u has applied for an account.\n\n%uri", array('%u' => $account->name, '%uri' => url("user/$account->uid/edit", NULL, NULL, TRUE))), "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
return t('Thank you for applying for an account. Your account is currently pending approval by the site administrator. In the meantime, your password and further instructions have been sent to your e-mail address.');
}
}
}
}
// Display the registration form.
$output .= variable_get('user_registration_help', '');
$affiliates = user_auth_help_links();
if (count($affiliates) > 0) {
$affiliates = implode(', ', $affiliates);
$output .= '
'. t('Note: if you have an account with one of our affiliates (%s), you may login now instead of registering.', array('%s' => $affiliates, '%login_uri' => url('user/login'))) .'
';
}
$output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64, t('Your full name or your preferred username; only letters, numbers and spaces are allowed.'));
$output .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 64, t('A password and instructions will be sent to this e-mail address, so make sure it is accurate.'));
$output .= form_submit(t('Create new account'));
$items[] = l(t('Request new password'), 'user/password');
$items[] = l(t('Log in'), 'user/login');
$output .= theme('item_list', $items);
$output = form_group(t('Create new user account'), $output);
return form($output);
}
function user_edit_form($uid, $edit) {
// Account information:
$group = form_textfield(t('Username'), 'name', $edit['name'], 30, 55, t('Your full name or your preferred username: only letters, numbers and spaces are allowed.'), NULL, TRUE);
$group .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 55, t('Insert a valid e-mail address. All e-mails from the system will be sent to this address. The e-mail address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by e-mail.'), NULL, TRUE);
$group .= form_item(t('Password'), ' ', t('Enter your new password twice if you want to change your current password, or leave it blank if you are happy with your current password.'), NULL, TRUE);
if (user_access('administer users')) {
$group .= form_radios(t('Status'), 'status', $edit['status'], array(t('Blocked'), t('Active')));
$group .= form_checkboxes(t('Roles'), 'roles', array_keys($edit['roles']), user_roles(1), t('Select at least one role. The user receives the combined permissions of all of the selected roles.'), NULL, TRUE);
}
$data[] = array('title' => t('Account information'), 'data' => $group, 'weight' => 0);
// Picture/avatar:
if (variable_get('user_pictures', 0)) {
$group = '';
if (file_exists($edit['picture'])) {
$group .= theme('image', file_create_url($edit['picture']));
}
$group .= form_file(t('Upload picture'), 'picture', 48, t('Your virtual face or picture. Maximum dimensions are %dimensions and the maximum size is %size kB.', array('%dimensions' => variable_get('user_picture_dimensions', '85x85'), '%size' => variable_get('user_picture_file_size', '30'))) .' '. variable_get('user_picture_guidelines', ''));
$data[] = array('title' => t('Picture'), 'data' => $group, 'weight' => 1);
}
return $data;
}
function user_edit_validate($uid, &$edit) {
// Validate the username:
if ($error = user_validate_name($edit['name'])) {
form_set_error('name', $error);
}
else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(name) = LOWER('%s')", $uid, $edit['name'])) > 0) {
form_set_error('name', t('The name "%s" is already taken.', array('%s' => $edit['name'])));
}
else if (user_deny('user', $edit['name'])) {
form_set_error('name', t('The name "%s" has been denied access.', array('%s' => $edit['name'])));
}
// Validate the e-mail address:
if ($error = user_validate_mail($edit['mail'])) {
form_set_error('mail', $error);
}
else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(mail) = LOWER('%s')", $uid, $edit['mail'])) > 0) {
form_set_error('mail', t('The e-mail address "%s" is already taken.', array('%s' => $edit['mail'])));
}
else if (user_deny('mail', $edit['mail'])) {
form_set_error('mail', t('The e-mail address "%s" has been denied access.', array('%s' => $edit['mail'])));
}
// If required, validate the uploaded picture.
if ($file = file_check_upload('picture')) {
$user = user_load(array('uid' => $uid));
user_validate_picture($file, $edit, $user);
}
// If required, check that proposed passwords match. If so, add the new password to $edit.
if ($edit['pass1']) {
if ($edit['pass1'] == $edit['pass2']) {
$edit['pass'] = $edit['pass1'];
}
else {
form_set_error('pass2', t('The specified passwords do not match.'));
}
}
unset($edit['pass1'], $edit['pass2']);
return $edit;
}
function user_edit($category = 'account') {
global $user;
$account = user_load(array('uid' => arg(1)));
$edit = $_POST['op'] ? $_POST['edit'] : object2array($account);
if ($_POST['op'] == t('Save account')) {
user_module_invoke('validate', $edit, $account, $category);
if (!form_get_errors()) {
// Validate input to ensure that non-privileged users can't alter protected data.
if (!user_access('administer users') && array_intersect(array_keys($edit), array('uid', 'roles', 'init', 'session'))) {
watchdog('warning', t('detected malicious attempt to alter a protected database field.'));
}
else {
user_save($account, $edit, $category);
drupal_set_message(t('the changes have been saved.'));
drupal_goto("user/$account->uid");
}
}
}
else if ($_POST['op'] == t('Delete account')) {
if ($account->status == 0) {
db_query('DELETE FROM {users} WHERE uid = %d', $account->uid);
db_query('DELETE FROM {users_roles} WHERE uid = %d', $account->uid);
db_query('DELETE FROM {authmap} WHERE uid = %d', $account->uid);
drupal_set_message(t('the account has been deleted.'));
module_invoke_all('user', 'delete', $edit, $account);
print theme('page', user_admin_account());
drupal_goto('admin/user');
}
else {
drupal_set_message(t('failed to delete account: the account has to be blocked first.'), 'error');
}
}
$output = _user_forms($edit, $account, $category);
$output .= form_submit(t('Save account'));
if (user_access('administer users')) {
$output .= form_submit(t('Delete account'));
}
$output = form($output, 'post', 0, array('enctype' => 'multipart/form-data'));
print theme('page', $output, $account->name);
}
function user_view($uid = 0) {
global $user;
if ($uid == 0) {
if ($user->uid) {
// Retrieve and merge all profile fields:
$fields = array();
foreach (module_list() as $module) {
if ($data = module_invoke($module, 'user', 'view', '', $user)) {
foreach ($data as $category => $content) {
$fields[$category] .= $content;
}
}
}
print theme('page', theme('user_profile', $user, $fields), $user->name);
}
else {
$output = user_login();
if (variable_get('user_register', 1)) {
$output .= user_register();
}
$output .= user_pass();
print theme('page', $output, t('User login'));
}
}
else {
if ($account = user_load(array('uid' => $uid, 'status' => 1))) {
// Retrieve and merge all profile fields:
$fields = array();
foreach (module_list() as $module) {
if ($data = module_invoke($module, 'user', 'view', '', $account)) {
foreach ($data as $category => $content) {
$fields[$category] .= $content;
}
}
}
print theme('page', theme('user_profile', $account, $fields), $account->name);
}
else {
drupal_not_found();
}
}
}
function user_page() {
$edit = $_POST['edit'];
$op = $_POST['op'];
if (empty($op)) {
$op = arg(2) ? arg(2) : arg(1);
}
switch ($op) {
case t('E-mail new password'):
case 'password':
print theme('page', user_pass($edit), t('E-mail new password'));
break;
case t('Create new account'):
case 'register':
$output = user_register($edit);
if (variable_get('user_register', 1)) {
print theme('page', $output, t('Create new account'));
}
else {
drupal_access_denied();
}
break;
case t('Log in'):
case 'login':
$output = user_login($edit);
print theme('page', $output, t('Log in'));
break;
case 'logout':
print user_logout();
break;
default:
print user_view(arg(1));
}
}
/*** Administrative features ***********************************************/
function _user_mail_text($messageid, $variables = array()) {
// Check if an admin setting overrides the default string.
if ($admin_setting = variable_get('user_mail_' . $messageid, FALSE)) {
return strtr($admin_setting, $variables);
}
// No override, return with default strings.
else {
switch ($messageid) {
case 'welcome_subject':
return t('Account details for %username at %site', $variables);
case 'welcome_body':
return t("%username,\n\nThank you for registering at %site. You may now log in to %login_uri using the following username and password:\n\nusername: %username\npassword: %password\n\nAfter logging in, you may wish to change your password at %edit_uri\n\nYour new %site membership also enables to you to login to other Drupal powered websites (e.g. http://www.drop.org/) without registering. Just use the following Drupal ID and password:\n\nDrupal ID: %username@%uri_brief\npassword: %password\n\n\n-- %site team", $variables);
case 'approval_subject':
return t('Account details for %username at %site (pending admin approval)', $variables);
case 'approval_body':
return t("%username,\n\nThank you for registering at %site. Your application for an account is currently pending approval. Once it has been granted, you may log in to %login_uri using the following username and password:\n\nusername: %username\npassword: %password\n\nAfter logging in, you may wish to change your password at %edit_uri\n\nYour new %site membership also enables to you to login to other Drupal powered websites (e.g. http://www.drop.org/) without registering. Just use the following Drupal ID and password:\n\nDrupal ID: %username@%uri_brief\npassword: %password\n\n\n-- %site team", $variables);
case 'pass_subject':
return t('Replacement login information for %username at %site', $variables);
case 'pass_body':
return t("%username,\n\nHere is your new password for %site. You may now login to %login_uri using the following username and password:\n\nusername: %username\npassword: %password\n\nAfter logging in, you may wish to change your password at %edit_uri", $variables);
}
}
}
function user_configure_settings() {
// User registration settings.
$group = form_radios(t('Public registrations'), 'user_register', variable_get('user_register', 1), array(t('Only site administrators can create new user accounts.'), t('Visitors can create accounts and no administrator approval is required.'), t('Visitors can create accounts but administrator approval is required.')));
$group .= form_textarea(t('User registration guidelines'), 'user_registration_help', variable_get('user_registration_help', ''), 70, 4, t('This text is displayed at the top of the user registration form. It\'s useful for helping or instructing your users.'));
$output = form_group(t('User registration settings'), $group);
// User e-mail settings.
$group = form_textfield(t('Subject of welcome e-mail'), 'user_mail_welcome_subject', _user_mail_text('welcome_subject'), 70, 180, t('Customize the subject of your welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri.');
$group .= form_textarea(t('Body of welcome e-mail'), 'user_mail_welcome_body', _user_mail_text('welcome_body'), 70, 10, t('Customize the body of the welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %login_uri, %edit_uri.');
$group .= form_textfield(t('Subject of welcome e-mail (awaiting admin approval)'), 'user_mail_approval_subject', _user_mail_text('approval_subject'), 70, 180, t('Customize the subject of your awaiting approval welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri.');
$group .= form_textarea(t('Body of welcome e-mail (awaiting admin approval)'), 'user_mail_approval_body', _user_mail_text('approval_body'), 70, 10, t('Customize the body of the awaiting approval welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %login_uri, %edit_uri.');
$group .= form_textfield(t('Subject of password recovery e-mail'), 'user_mail_pass_subject', _user_mail_text('pass_subject'), 70, 180, t('Customize the Subject of your forgotten password e-mail.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri.');
$group .= form_textarea(t('Body of password recovery e-mail'), 'user_mail_pass_body', _user_mail_text('pass_body'), 70, 10, t('Customize the body of the forgotten password e-mail.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %login_uri, %edit_uri.');
$output .= form_group(t('User email settings'), $group);
// Picture settings.
if (!file_check_directory(file_create_path(variable_get('user_picture_path', 'pictures')))) {
form_set_error('user_picture_path', t('the picture directory does not exist, or is not writable.'));
}
$group = form_radios(t('Picture support'), 'user_pictures', variable_get('user_pictures', 0), array(t('Disabled'), t('Enabled')), t('Enable picture support.'));
$group .= form_textfield(t('Picture image path'), 'user_picture_path', variable_get('user_picture_path', 'pictures'), 45, 255, t('Subdirectory in the directory "%dir" where pictures will be stored.', array('%dir' => variable_get('file_directory_path', 'files') . FILE_SEPARATOR)));
$group .= form_textfield(t('Default picture'), 'user_picture_default', variable_get('user_picture_default', ''), 45, 255, t('URL of picture to display for users with no custom picture selected. Leave blank for none.'));
$group .= form_textfield(t('Picture maximum dimensions'), 'user_picture_dimensions', variable_get('user_picture_dimensions', '85x85'), 10, 10, t('Maximum dimensions for pictures.'));
$group .= form_textfield(t('Picture maximum file size'), 'user_picture_file_size', variable_get('user_picture_file_size', '30'), 10, 10, t('Maximum file size for pictures, in kB.'));
$group .= form_textarea(t('Picture guidelines'), 'user_picture_guidelines', variable_get('user_picture_guidelines', ''), 70, 4, t('This text is displayed at the picture upload form in addition to the default guidelines. It\'s useful for helping or instructing your users.'));
$output .= form_group(t('Pictures'), $group);
// "Who's online" block settings.
$period = drupal_map_assoc(array(30, 60, 120, 180, 300, 600, 900, 1800, 2700, 3600, 5400, 7200, 10800, 21600, 43200, 86400), 'format_interval');
$group = form_select(t('User activity'), 'user_block_seconds_online', variable_get('user_block_seconds_online', 900), $period, t('Affects "Who\'s online" block. A user is considered online for this long after they have last viewed a page.'));
$group .= form_select(t('User list length'), 'user_block_max_list_count', variable_get('user_block_max_list_count', 10), drupal_map_assoc(array(0, 5, 10, 15, 20, 25, 30, 40, 50, 75, 100)), t('Affects "Who\'s online" block. Maximum number of currently online users to display.'));
$output .= form_group(t('"Who\'s online" block settings'), $group);
return $output;
}
function user_admin_create($edit = array()) {
if ($edit) {
user_module_invoke('validate', $edit, $edit, 'account');
if (!form_get_errors()) {
watchdog('user', t('new user: "%user" <%address>.', array('%user' => $edit['name'], '%address' => $edit['mail'])));
user_save('', array('name' => $edit['name'], 'pass' => $edit['pass'], 'init' => $edit['mail'], 'mail' => $edit['mail'], 'roles' => array(_user_authenticated_id()), 'status' => 1));
drupal_set_message(t('created a new user account. No e-mail has been sent.'));
return;
}
}
$output = form_textfield(t('Username'), 'name', $edit['name'], 30, 55, t('Provide the username of the new account.'), NULL, TRUE);
$output .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 55, t('Provide the e-mail address associated with the new account.'), NULL, TRUE);
$output .= form_password(t('Password'), 'pass', $edit['pass'], 30, 55, t('Provide a password for the new account.'), NULL, TRUE);
$output .= form_submit(t('Create account'));
$output = form_group(t('Create new user account'), $output);
return form($output);
}
function user_admin_access($edit = array()) {
$type = arg(4);
if (empty($type)) {
return;
}
$op = $_POST['op'];
$id = arg(5);
if ($op == t('Add rule')) {
$aid = db_next_id('{access}_aid');
db_query("INSERT INTO {access} (aid, mask, type, status) VALUES ('%s', '%s', '%s', %d)", $aid, $edit['mask'], $type, $edit['status']);
drupal_set_message(t('the access rule has been added.'));
}
else if ($op == t('Check')) {
if (user_deny($type, $edit['test'])) {
drupal_set_message(t('%test is not allowed.', array('%test' => $edit['test'])));
}
else {
drupal_set_message(t('%test is allowed.', array('%test' => $edit['test'])));
}
}
else if ($id) {
db_query('DELETE FROM {access} WHERE aid = %d', $id);
drupal_set_message(t('the access rule has been deleted.'));
}
$header = array(t('type'), t('mask'), t('operations'));
$result = db_query("SELECT * FROM {access} WHERE type = '%s' AND status = 1 ORDER BY mask", $type);
while ($rule = db_fetch_object($result)) {
$rows[] = array(t('Allow'), $rule->mask, array('data' => l(t('delete'), "admin/user/configure/access/$type/$rule->aid"), 'align' => 'center'));
}
$result = db_query("SELECT * FROM {access} WHERE type = '%s' AND status = 0 ORDER BY mask", $type);
while ($rule = db_fetch_object($result)) {
$rows[] = array(t('Deny'), $rule->mask, l(t('delete'), "admin/user/configure/access/$type/$rule->aid"));
}
$options = array('1' => t('Allow'), '0' => t('Deny'));
$rows[] = array(form_radios(NUll, 'status', $edit['status'], $options), form_textfield(NULL, 'mask', $edit['mask'], 32, 64), form_submit(t('Add rule')));
$output .= theme('table', $header, $rows);
$output .= '
%: '. t('Matches any number of characters, even zero characters') .'. _: '. t('Matches exactly one character.') .'
';
if ($type != 'user') {
$title = t('Check e-mail address');
}
else {
$title = t('Check username');
}
$output .= form_textfield($title, 'test', $edit['test'], 32, 64). form_submit(t('Check'));
return form($output);
}
function user_roles($membersonly = 0) {
$result = db_query('SELECT * FROM {role} ORDER BY name');
while ($role = db_fetch_object($result)) {
if (!$membersonly || ($membersonly && $role->name != 'anonymous user')) {
$roles[$role->rid] = $role->name;
}
}
return $roles;
}
function user_admin_perm($edit = array()) {
if ($edit) {
// Save permissions:
$result = db_query('SELECT * FROM {role} ');
while ($role = db_fetch_object($result)) {
// Delete, so if we clear every checkbox we reset that role;
// otherwise permissions are active and denied everywhere.
db_query('DELETE FROM {permission} WHERE rid = %d', $role->rid);
$perm = $edit[$role->rid] ? implode(', ', array_keys($edit[$role->rid])) : '';
if ($perm) {
db_query("INSERT INTO {permission} (rid, perm) VALUES (%d, '%s')", $role->rid, $perm);
}
}
// Clear the cache, as we might have changed the anonymous user's
// permissions.
cache_clear_all();
}
// Compile permission array:
$perms = module_invoke_all('perm');
asort($perms);
// Compile role array:
$result = db_query('SELECT r.rid, p.perm FROM {role} r LEFT JOIN {permission} p ON r.rid = p.rid ORDER BY name');
$roles = array();
while ($role = db_fetch_object($result)) {
$role_perms[$role->rid] = $role->perm;
}
$result = db_query('SELECT rid, name FROM {role} ORDER BY name');
$role_names = array();
while ($role = db_fetch_object($result)) {
$role_names[$role->rid] = $role->name;
}
// Render role/permission overview:
$header = array_merge(array(' '), $role_names);
foreach ($perms as $perm) {
$row[] = t($perm);
foreach ($role_names as $rid => $name) {
$row[] = "';
}
$rows[] = $row;
unset($row);
}
$output = theme('table', $header, $rows);
$output .= form_submit(t('Save permissions'));
return form($output);
}
function user_admin_role($edit = array()) {
$op = $_POST['op'];
$id = arg(4);
if ($op == t('Save role')) {
db_query("UPDATE {role} SET name = '%s' WHERE rid = %d", $edit['name'], $id);
}
else if ($op == t('Delete role')) {
db_query('DELETE FROM {role} WHERE rid = %d', $id);
db_query('DELETE FROM {permission} WHERE rid = %d', $id);
// Update the users who have this role set:
$result = db_query('SELECT DISTINCT(ur1.uid) FROM {users_roles} ur1 LEFT JOIN {users_roles} ur2 ON ur2.uid = ur1.uid WHERE ur1.rid = %d AND ur2.rid != ur1.rid', $id);
$uid = array();
while ($u = db_fetch_object($result)) {
$uid[] = $u->uid;
}
if ($uid) {
db_query('DELETE FROM {users_roles} WHERE rid = %d AND uid IN (%s)', $id, implode(', ', $uid));
}
// Users with only the deleted role are put back in the authenticated users pool.
db_query('UPDATE {users_roles} SET rid = %d WHERE rid = %d', _user_authenticated_id(), $id);
}
else if ($op == t('Add role')) {
db_query("INSERT INTO {role} (name) VALUES ('%s')", $edit['name']);
}
else if ($id) {
// Display the role form.
$role = db_fetch_object(db_query('SELECT * FROM {role} WHERE rid = %d', $id));
$output .= form_textfield(t('Role name'), 'name', $role->name, 32, 64, t('The name for this role. Example: "moderator", "editorial board", "site architect".'));
$output .= form_submit(t('Save role'));
$output .= form_submit(t('Delete role'));
$output = form($output);
}
if (!$output) {
// Render the role overview.
$result = db_query('SELECT * FROM {role} ORDER BY name');
$header = array(t('name'), t('operations'));
while ($role = db_fetch_object($result)) {
if ($role->name != 'anonymous user' && $role->name != 'authenticated user') {
$rows[] = array($role->name, array('data' => l(t('edit'), "admin/user/configure/role/$role->rid"), 'align' => 'center'));
}
else {
$rows[] = array($role->name, array('data' => ''. t('locked') .'', 'align' => 'center'));
}
}
$rows[] = array('', '');
$output = theme('table', $header, $rows);
$output = form($output);
}
return $output;
}
function user_admin_account() {
$header = array(
array('data' => t('ID'), 'field' => 'u.uid'),
array('data' => t('username'), 'field' => 'u.name'),
array('data' => t('status'), 'field' => 'u.status'),
array('data' => t('roles')),
array('data' => t('last access'), 'field' => 'u.changed', 'sort' => 'desc'),
t('operations')
);
$sql = 'SELECT u.uid, u.name, u.status, u.changed FROM {users} u WHERE uid != 0';
$sql .= tablesort_sql($header);
$result = pager_query($sql, 50);
$status = array(t('blocked'), t('active'));
while ($account = db_fetch_object($result)) {
$rolesresult = db_query('SELECT r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $account->uid);
$roles = array();
while ($role = db_fetch_object($rolesresult)) {
$roles[] = $role->name;
}
$rows[] = array($account->uid, format_name($account), $status[$account->status], implode(', ', $roles), format_date($account->changed, 'small'), l(t('edit'), "user/$account->uid/edit"));
}
$pager = theme('pager', NULL, 50, 0, tablesort_pager());
if (!empty($pager)) {
$rows[] = array(array('data' => $pager, 'colspan' => 6));
}
return theme('table', $header, $rows);
}
function user_configure() {
$op = $_POST['op'];
$edit = $_POST['edit'];
if (empty($op)) {
$op = arg(3);
}
switch ($op) {
case t('Add rule'):
case t('Check'):
case 'access':
$output = user_admin_access($edit);
break;
case t('Save permissions'):
drupal_set_message(t('the user permissions have been saved.'));
case 'permission':
$output = user_admin_perm($edit);
break;
case t('Add role'):
case t('Delete role'):
case t('Save role'):
drupal_set_message(t('your role changes were saved.'));
case 'role':
$output = user_admin_role($edit);
break;
default:
if ($_POST) system_settings_save();
$output = system_settings_form(user_configure_settings());
}
print theme('page', $output);
}
function user_admin() {
$op = $_POST['op'];
$edit = $_POST['edit'];
if (empty($op)) {
$op = arg(2);
}
switch ($op) {
case 'search':
$output = search_type('user', url('admin/user/search'), $_POST['keys']);
break;
case t('Create account'):
case 'create':
$output = user_admin_create($edit);
break;
default:
$output = user_admin_account();
}
print theme('page', $output);
}
/**
* Implementation of hook_help().
*/
function user_help($section) {
switch ($section) {
case 'admin/user':
return t('Drupal allows users to register, login, logout, maintain user profiles, etc. No participant can use his own name to post content until he signs up for a user account.');
case 'admin/user/create':
case 'admin/user/account/create':
return t('This web page allows the administrators to register a new users by hand. Note that you cannot have a user where either the e-mail address or the username match another user in the system.');
case 'admin/user/configure/access':
return t('Access rules allow Drupal administrators to choose usernames and e-mail address that are prevented from using drupal. To enter the mask for e-mail addresses click on e-mail rules, for the username mask click on name rules.', array('%e-mail' => url('admin/user/configure/access/mail'), '%username' => url('admin/user/configure/access/name')));
case 'admin/user/configure/access/mail':
return t('Setup and test the e-mail access rules. The access function checks if you match a deny and not an allow. If you match only a deny then it is denied. Any other case, such as both a deny and an allow pattern matching, allows the pattern.');
case 'admin/user/configure/access/name':
return t('Setup and test the username access rules. The access function checks if you match a deny and not an allow. If you do then it is denied. Any other case, such as a deny pattern and an allow pattern, allows the pattern.');
case 'admin/user/configure/permission':
return t('In this area you will define the permissions for each user role (role names are defined on the user roles page). Each permission describes a fine-grained logical operation, such as being able to access the administration pages, or adding/modifying a user account. You could say a permission represents access granted to a user to perform a set of operations.', array('%role' => url('admin/user/configure/role')));
case 'admin/user/configure/role':
return t('
Roles allow you to fine tune the security and administration of drupal. A role defines a group of users that have certain privileges as defined in user permissions. Examples of roles include: anonymous user, authenticated user, moderator, administrator and so on. In this area you will define the role names of the various roles. To delete a role choose "edit". By default, Drupal comes with two user roles:
Anonymous user: this role is used for users that don\'t have a user account or that are not authenticated.
Authenticated user: this role is assigned automatically to authenticated users. Most registered users will belong to this user role unless specified otherwise.
', array('%permission' => url('admin/user/configure/permission')));
case 'admin/user/search':
return t('Enter a simple pattern ("*" may be user as a wildcard match) to search for a username. For example, one may search for "br" and Drupal might return "brian", "brad", and "brenda".');
case 'admin/modules#description':
return t('Enables the user registration and login system.');
case 'admin/user/configure':
case 'admin/user/configure/settings':
return t('In order to use the full power of Drupal a visitor must sign up for an account. This page lets you setup how a user signs up, logs out, the guidelines from the system about user subscriptions, and the e-mails the system will send to the user.');
case 'user/help#user':
$site = variable_get('site_name', 'this website');
$output = t("
Distributed authentication
One of the more tedious moments in visiting a new website is filling out the registration form. Here at %site, you do not have to fill out a registration form if you are already a member of %help-links. This capability is called distributed authentication, and is unique to Drupal, the software which powers %site.
Distributed authentication enables a new user to input a username and password into the login box, and immediately be recognized, even if that user never registered at %site. This works because Drupal knows how to communicate with external registration databases. For example, lets say that new user 'Joe' is already a registered member of Delphi Forums. Drupal informs Joe on registration and login screens that he may login with his Delphi ID instead of registering with %site. Joe likes that idea, and logs in with a username of joe@remote.delphiforums.com and his usual Delphi password. Drupal then contacts the remote.delphiforums.com server behind the scenes (usually using XML-RPC, HTTP POST, or SOAP) and asks: \"Is the password for user Joe correct?\". If Delphi replies yes, then we create a new %site account for Joe and log him into it. Joe may keep on logging into %site in the same manner, and he will always be logged into the same account.
Drupal offers a powerful access system that allows users to register, login, logout, maintain user profiles, etc. By using roles you can setup fine grained permissions allowing each role to do only what you want them to. Each user is assigned to one or more roles. By default there are two roles \"anonymous\" - a user who has not logged in, and \"authorized\" a user who has signed up and who has been authorized. As anonymous users, participants suffer numerous disadvantages, for example they cannot sign their names to nodes, and their moderated posts beginning at a lower score.
In contrast, those with a user account can use their own name or handle and are granted various privileges: the most important is probably the ability to moderate new submissions, to rate comments, and to fine-tune the site to their personal liking, with saved personal settings. Drupal themes make fine tuning quite a pleasure.
Registered users need to authenticate by supplying either a local username and password, or a remote username and password such as a Jabber ID, DelphiForums ID, or one from a Drupal powered website. See the distributed authentication help for more information on this innovative feature.
The local username and password, hashed with Message Digest 5 (MD5), are stored in your database. When you enter a password it is also hashed with MD5 and compared with what is in the database. If the hashes match, the username and password are correct. Once a user authenticated session is started, and until that session is over, the user won't have to re-authenticate. To keep track of the individual sessions, Drupal relies on PHP sessions. A visitor accessing your website is assigned an unique ID, the so-called session ID, which is stored in a cookie. For security's sake, the cookie does not contain personal information but acts as a key to retrieve the information stored on your server. When a visitor accesses your site, Drupal will check whether a specific session ID has been sent with the request. If this is the case, the prior saved environment is recreated.
User preferences and profiles
Each Drupal user has a profile, and a set of preferences which may be edited by clicking on the \"my account\" link. Of course, a user must be logged into reach those pages. There, users will find a page for changing their preferred time zone, language, username, e-mail address, password, theme, signature, and distributed authentication names. Changes made here take effect immediately. Also, administrators may make profile and preferences changes in account administration on behalf of their users.
Distributed authentication
One of the more tedious moments in visiting a new website is filling out the registration form. The reg form provides helpful information to the website owner, but not much value for the user. The value for the end user is usually the ability to post a messages or receive personalized news, etc. Distributed authentication (DA) gives the user what they want without having to fill out the reg form. Removing this obstacle yields more registered and active users for the website.
DA enables a new user to input a username and password into the login box and immediately be recognized, even if that user never registered on your site. This works because Drupal knows how to communicate with external registration databases. For example, lets say that your new user 'Joe' is already a registered member of Delphi Forums. If your Drupal has the delphi module installed, then Drupal will inform Joe on the registration and login screens that he may login with his Delphi ID instead of registering with your Drupal instance. Joe likes that idea, and logs in with a username of joe@remote.delphiforums.com and his usual Delphi password. Drupal then communicates with remote.delphiforums.com (usually using XML, HTTP-POST, or SOAP) behind the scenes and asks "is this password for username=joe?" If Delphi replies yes, then Drupal will create a new local account for joe and log joe into it. Joe may keep on logging into your Drupal instance in the same manner, and he will be logged into the same joe@remote.delphiforums.com account.
One key element of DA is the 'authmap' table, which maps a user's authname (e.g. joe@remote.delphiforums.com) to his local UID (i.e. user identification number). This map is checked whenever a user successfully logs into an external authentication source. Once Drupal knows that the current user is definitely joe@remote.delphiforums.com (because Delphi says so), he looks up Joe's UID and logs Joe into that account.
To disable distributed authentication, simply disable or remove all DA modules. For a virgin install, that means removing/disabling the jabber module and the drupal module.
Drupal is setup so that it is very easy to add support for any external authentication source. You currently have the following authentication modules installed ...