path: root/modules/user.module

<?php
// $Id$

/**
 * @file
 * Enables the user registration and login system.
 */

/**
 * Invokes hook_user() in every module.
 *
 * We cannot use module_invoke() for this, because the arguments need to
 * be passed by reference.
 */
function user_module_invoke($type, &$array, &$user, $category = NULL) {
  foreach (module_list() as $module) {
    $function = $module .'_user';
    if (function_exists($function)) {
      $function($type, $array, $user, $category);
    }
  }
}

function user_external_load($authname) {
  $result = db_query("SELECT uid FROM {authmap} WHERE authname = '%s'", $authname);

  if ($user = db_fetch_object($result)) {
    return user_load($user);
  }
  else {
    return 0;
  }
}

/**
 * Fetch a user object.
 *
 * @param $array
 *   An associative array of attributes to search for in selecting the
 *   user, such as user name or email address.
 *
 * @return
 *   A fully-loaded $user object.
 */
function user_load($array = array()) {
  // Dynamically compose a SQL query:
  $query = '';

  $params = array();
  foreach ($array as $key => $value) {
    if ($key == 'pass') {
      $query .= "u.pass = '%s' AND ";
      $params[] = md5($value);
    }
    else if ($key == 'uid') {
      $query .= "u.uid = %d AND ";
      $params[] = $value;
    }
    else {
      $query .= "LOWER(u.$key) = LOWER('%s') AND ";
      $params[] = $value;
    }
  }
  $result = db_query_range("SELECT u.* FROM {users} u WHERE $query u.status < 3", $params, 0, 1);

  if (db_num_rows($result)) {
    $user = db_fetch_object($result);
    $user = drupal_unpack($user);

    $user->roles = array();
    $result = db_query('SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $user->uid);
    while ($role = db_fetch_object($result)) {
      $user->roles[$role->rid] = $role->name;
    }
    user_module_invoke('load', $array, $user);
  }
  else {
    $user = new StdClass();
  }

  return $user;
}

/**
 * Save changes to a user account.
 *
 * @param $account
 *   The $user object for the user to modify.
 *
 * @param $array
 *   An array of fields and values to save. For example array('name' => 'My name');
 *   Setting a field to null deletes it from the data column.
 *
 * @param $category
 *   (optional) The category for storing profile information in.
 */
function user_save($account, $array = array(), $category = 'account') {
  // Dynamically compose a SQL query:
  $user_fields = user_fields();
  if ($account->uid) {
    user_module_invoke('update', $array, $account, $category);

    $data = unserialize(db_result(db_query('SELECT data FROM {users} WHERE uid = %d', $account->uid)));
    foreach ($array as $key => $value) {
      if ($key == 'pass') {
        $query .= "$key = '%s', ";
        $v[] = md5($value);
      }
      else if (substr($key, 0, 4) !== 'auth') {
        if (in_array($key, $user_fields)) {
          // Save standard fields
          $query .= "$key = '%s', ";
          $v[] = $value;
        }
        else if ($key != 'roles') {
          // Roles is a special case: it used below.
          if ($value === null) {
            unset($data[$key]);
          }
          else {
            $data[$key] = $value;
          }
        }
      }
    }
    $query .= "data = '%s' ";
    $v[] = serialize($data);

    db_query("UPDATE {users} SET $query WHERE uid = %d", array_merge($v, array($account->uid)));

    // Reload user roles if provided
    if (is_array($array['roles'])) {
      db_query('DELETE FROM {users_roles} WHERE uid = %d', $account->uid);

      foreach (array_keys($array['roles']) as $rid) {
        db_query('INSERT INTO {users_roles} (uid, rid) VALUES (%d, %d)', $account->uid, $rid);
      }
    }

    // Delete a blocked user's sessions to kick them if they are online.
    if (isset($array['status']) && $array['status'] == 0) {
      db_query('DELETE FROM {sessions} WHERE uid = %d', $account->uid);
    }

    // Refresh user object
    $user = user_load(array('uid' => $account->uid));
  }
  else {
    $array['created'] = time();
    $array['uid'] = db_next_id('{users}_uid');

    // Note, we wait with saving the data column to prevent module-handled
    // fields from being saved there. We cannot invoke hook_user('insert') here
    // because we don't have a fully initialized user object yet.
    foreach ($array as $key => $value) {
      if ($key == 'pass') {
        $fields[] = db_escape_string($key);
        $values[] = md5($value);
        $s[] = "'%s'";
      }
      else if (substr($key, 0, 4) !== 'auth') {
        if (in_array($key, $user_fields)) {
          $fields[] = db_escape_string($key);
          $values[] = $value;
          $s[] = "'%s'";
        }
      }
    }
    db_query('INSERT INTO {users} ('. implode(', ', $fields) .') VALUES ('. implode(', ', $s) .')', $values);

    // Reload user roles (delete just to be safe).
    db_query('DELETE FROM {users_roles} WHERE uid = %d', $array['uid']);
    foreach ($array['roles'] as $rid) {
      db_query('INSERT INTO {users_roles} (uid, rid) VALUES (%d, %d)', $array['uid'], $rid);
    }

    // Build the initial user object.
    $user = user_load(array('uid' => $array['uid']));

    user_module_invoke('insert', $array, $user, $category);

    // Build and save the serialized data field now
    $data = array();
    foreach ($array as $key => $value) {
      if ((substr($key, 0, 4) !== 'auth') && (!in_array($key, $user_fields)) && ($value !== null)) {
        $data[$key] = $value;
      }
    }
    db_query("UPDATE {users} SET data = '%s' WHERE uid = %d", serialize($data), $user->uid);

    // Build the finished user object.
    $user = user_load(array('uid' => $array['uid']));
  }

  // Save distributed authentication mappings
  $authmaps = array();
  foreach ($array as $key => $value) {
    if (substr($key, 0, 4) == 'auth') {
      $authmaps[$key] = $value;
    }
  }
  if (sizeof($authmaps) > 0) {
    user_set_authmaps($user, $authmaps);
  }

  return $user;
}

/**
 * Verify the syntax of the given name.
 */
function user_validate_name($name) {
  if (!strlen($name)) return t('You must enter a username.');
  if (substr($name, 0, 1) == ' ') return t('The username cannot begin with a space.');
  if (substr($name, -1) == ' ') return t('The username cannot end with a space.');
  if (ereg('  ', $name)) return t('The username cannot contain multiple spaces in a row.');
  if (ereg("[^\x80-\xF7 [:alnum:]@_.-]", $name)) return t('The username contains an illegal character.');
  if (preg_match('/[\x{80}-\x{A0}'.          // Non-printable ISO-8859-1 + NBSP
                   '\x{AD}'.                 // Soft-hyphen
                   '\x{2000}-\x{200F}'.      // Various space characters
                   '\x{2028}-\x{202F}'.      // Bidirectional text overrides
                   '\x{205F}-\x{206F}'.      // Various text hinting characters
                   '\x{FEFF}'.               // Byte order mark
                   '\x{FF01}-\x{FF60}'.      // Full-width latin
                   '\x{FFF9}-\x{FFFD}]/u',   // Replacement characters
                   $name)) {
    return t('The username contains an illegal character.');
  }
  if (ereg('@', $name) && !eregi('@([0-9a-z](-?[0-9a-z])*.)+[a-z]{2}([zmuvtg]|fo|me)?$', $name)) return t('The username is not a valid authentication ID.');
  if (strlen($name) > 56) return t('The username %name is too long: it must be less than 56 characters.', array('%name' => theme('placeholder', $name)));
}

function user_validate_mail($mail) {
  if (!$mail) return t('You must enter an e-mail address.');
  if (!valid_email_address($mail)) {
    return t('The e-mail address %mail is not valid.', array('%mail' => theme('placeholder', $mail)));
  }
}

function user_validate_picture($file, &$edit, $user) {
  // Initialize the picture:
  $edit['picture'] = $user->picture;

  // Check that uploaded file is an image, with a maximum file size
  // and maximum height/width.
  $info = image_get_info($file->filepath);
  list($maxwidth, $maxheight) = explode('x', variable_get('user_picture_dimensions', '85x85'));

  if (!$info || !$info['extension']) {
    form_set_error('picture', t('The uploaded file was not an image.'));
  }
  else if (image_get_toolkit()) {
    image_scale($file->filepath, $file->filepath, $maxwidth, $maxheight);
  }
  else if (filesize($file->filepath) > (variable_get('user_picture_file_size', '30') * 1000)) {
    form_set_error('picture', t('The uploaded image is too large; the maximum file size is %size kB.', array('%size' => variable_get('user_picture_file_size', '30'))));
  }
  else if ($info['width'] > $maxwidth || $info['height'] > $maxheight) {
    form_set_error('picture', t('The uploaded image is too large; the maximum dimensions are %dimensions pixels.', array('%dimensions' => variable_get('user_picture_dimensions', '85x85'))));
  }

  if (!form_get_errors()) {
    if ($file = file_save_upload('picture', variable_get('user_picture_path', 'pictures') .'/picture-'. $user->uid . '.' . $info['extension'], 1)) {
      $edit['picture'] = $file->filepath;
    }
    else {
      form_set_error('picture', t("Failed to upload the picture image; the %directory directory doesn't exist.", array('%directory' => '<em>'. variable_get('user_picture_path', 'pictures') .'</em>')));
    }
  }
}

function user_validate_authmap($account, $authname, $module) {
  $result = db_query("SELECT COUNT(*) from {authmap} WHERE uid != %d AND authname = '%s'", $account->uid, $authname);
  if (db_result($result) > 0) {
    $name = module_invoke($module, 'info', 'name');
    return t('The %u ID %s is already taken.', array('%u' => $name, '%s' => theme('placeholder', $authname)));
  }
}

/**
 * Generate a random alphanumeric password.
 */
function user_password($length = 10) {
  // This variable contains the list of allowable characters for the
  // password.  Note that the number 0 and the letter 'O' have been
  // removed to avoid confusion between the two.  The same is true
  // of 'I' and 1.
  $allowable_characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';

  // We see how many characters are in the allowable list:
  $len = strlen($allowable_characters);

  // Seed the random number generator with the microtime stamp.
  mt_srand((double)microtime() * 1000000);

  // Declare the password as a blank string.
  $pass = '';

  // Loop the number of times specified by $length.
  for ($i = 0; $i < $length; $i++) {

    // Each iteration, pick a random character from the
    // allowable string and append it to the password:
    $pass .= $allowable_characters[mt_rand(0, $len - 1)];
  }

  return $pass;
}

/**
 * Determine whether the user has a given privilege.
 *
 * @param $string
 *   The permission, such as "administer nodes", being checked for.
 * @param $account
 *   (optional) The account to check, if not given use currently logged in user.
 *
 * @return
 *   boolean TRUE if the current user has the requested permission.
 *
 * All permission checks in Drupal should go through this function. This
 * way, we guarantee consistent behavior, and ensure that the superuser
 * can perform all actions.
 */
function user_access($string, $account = NULL) {
  global $user;
  static $perm = array();

  if (is_null($account)) {
    $account = $user;
  }

  // User #1 has all privileges:
  if ($account->uid == 1) {
    return TRUE;
  }

  // To reduce the number of SQL queries, we cache the user's permissions
  // in a static variable.
  if (!isset($perm[$account->uid])) {
    $result = db_query('SELECT DISTINCT(p.perm) FROM {role} r INNER JOIN {permission} p ON p.rid = r.rid INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d', $account->uid);

    $perm[$account->uid] = '';
    while ($row = db_fetch_object($result)) {
      $perm[$account->uid] .= "$row->perm, ";
    }
  }

  if (isset($perm[$account->uid])) {
    return strpos($perm[$account->uid], "$string, ") !== FALSE;
  }

  return FALSE;
}

/**
 * Checks for usernames blocked by user administration
 *
 * @return boolean true for blocked users, false for active
 */
function user_is_blocked($name) {
  $allow = db_fetch_object(db_query("SELECT * FROM {users} WHERE status = 1 AND name = LOWER('%s')", $name));
  $deny  = db_fetch_object(db_query("SELECT * FROM {users} WHERE status = 0 AND name = LOWER('%s')", $name));

  return $deny && !$allow;
}

/**
 * Send an e-mail message.
 */
function user_mail($mail, $subject, $message, $header) {
  if (variable_get('smtp_library', '') && file_exists(variable_get('smtp_library', ''))) {
    include_once variable_get('smtp_library', '');
    return user_mail_wrapper($mail, $subject, $message, $header);
  }
  else {
    /*
    ** Note: if you are having problems with sending mail, or mails look wrong
    ** when they are received you may have to modify the str_replace to suit
    ** your systems.
    **  - \r\n will work under dos and windows.
    **  - \n will work for linux, unix and BSDs.
    **  - \r will work for macs.
    **
    ** According to RFC 2646, it's quite rude to not wrap your e-mails:
    **
    ** "The Text/Plain media type is the lowest common denominator of
    ** Internet email, with lines of no more than 997 characters (by
    ** convention usually no more than 80), and where the CRLF sequence
    ** represents a line break [MIME-IMT]."
    **
    ** CRLF === \r\n
    **
    ** http://www.rfc-editor.org/rfc/rfc2646.txt
    **
    */
    return mail(
      $mail,
      mime_header_encode($subject),
      str_replace("\r", '', $message),
      "MIME-Version: 1.0\nContent-Type: text/plain; charset=UTF-8; format=flowed\nContent-transfer-encoding: 8Bit\n" . $header
    );
  }
}

function user_fields() {
  static $fields;

  if (!$fields) {
    $result = db_query('SELECT * FROM {users} WHERE uid = 1');
    if (db_num_rows($result)) {
      $fields = array_keys(db_fetch_array($result));
    }
    else {
      // Make sure we return the default fields at least
      $fields = array('uid', 'name', 'pass', 'mail', 'picture', 'mode', 'sort', 'threshold', 'theme', 'signature', 'created', 'access', 'login', 'status', 'timezone', 'language', 'init', 'data');
    }
  }

  return $fields;
}

/**
 * Implementation of hook_perm().
 */
function user_perm() {
  return array('administer users', 'access user profiles');
}

/**
 * Implementation of hook_file_download().
 *
 * Ensure that user pictures (avatars) are always downloadable.
 */
function user_file_download($file) {
  if (strpos($file, variable_get('user_picture_path', 'pictures') .'/picture-') === 0) {
    $info = image_get_info(file_create_path($file));
    return array('Content-type: '. $info['mime_type']);
  }
}

/**
 * Implementation of hook_search().
 */
function user_search($op = 'search', $keys = null) {
  switch ($op) {
    case 'name':
      if (user_access('access user profiles')) {
        return t('users');
      }
    case 'search':
      if (user_access('access user profiles')) {
        $find = array();
        // Replace wildcards with MySQL/PostgreSQL wildcards.
        $keys = preg_replace('!\*+!', '%', $keys);
        $result = pager_query("SELECT * FROM {users} WHERE LOWER(name) LIKE LOWER('%%%s%%')", 15, 0, NULL, $keys);
        while ($account = db_fetch_object($result)) {
          $find[] = array('title' => $account->name, 'link' => url('user/'. $account->uid));
        }
        return $find;
      }
  }
}

/**
 * Implementation of hook_user().
 */
function user_user($type, &$edit, &$user, $category = NULL) {
  if ($type == 'view') {
    return array(t('History') => form_item(t('Member for'), format_interval(time() - $user->created)));
  }

  if ($type == 'form' && $category == 'account') {
    return user_edit_form(arg(1), $edit);
  }

  if ($type == 'validate' && $category == 'account') {
    return user_edit_validate(arg(1), $edit);
  }

  if ($type == 'categories') {
    return array(array('name' => 'account', 'title' => t('account settings'), 'weight' => 1));
  }
}

/**
 * Implementation of hook_block().
 */
function user_block($op = 'list', $delta = 0, $edit = array()) {
  global $user;

  if ($op == 'list') {
     $blocks[0]['info'] = t('User login');
     $blocks[1]['info'] = t('Navigation');
     $blocks[2]['info'] = t('Who\'s new');
     $blocks[3]['info'] = t('Who\'s online');

     return $blocks;
  }
  else if ($op == 'configure' && $delta == 3) {
    $period = drupal_map_assoc(array(30, 60, 120, 180, 300, 600, 900, 1800, 2700, 3600, 5400, 7200, 10800, 21600, 43200, 86400), 'format_interval');
    $output = form_select(t('User activity'), 'user_block_seconds_online', variable_get('user_block_seconds_online', 900), $period, t('A user is considered online for this long after they have last viewed a page.'));
    $output .= form_select(t('User list length'), 'user_block_max_list_count', variable_get('user_block_max_list_count', 10), drupal_map_assoc(array(0, 5, 10, 15, 20, 25, 30, 40, 50, 75, 100)), t('Maximum number of currently online users to display.'));

    return $output;
  }
  else if ($op == 'save' && $delta == 3) {
    variable_set('user_block_seconds_online', $edit['user_block_seconds_online']);
    variable_set('user_block_max_list_count', $edit['user_block_max_list_count']);
  }
  else if ($op == 'view') {
    $block = array();

    switch ($delta) {
      case 0:
        // For usability's sake, avoid showing two login forms on one page.
        if (!$user->uid && !(arg(0) == 'user' && !is_numeric(arg(1)))) {
          $edit = $_POST['edit'];

          // NOTE: special care needs to be taken because on pages with forms,
          // such as node and comment submission pages, the $edit variable
          // might already be set.

          $output .= form_textfield(t('Username'), 'name', $edit['name'], 15, 64);
          $output .= form_password(t('Password'), 'pass', '', 15, 64);
          $output .= form_submit(t('Log in'));

          $output  = form($output, 'post', url('user/login', drupal_get_destination()), array('id' => 'user-login-form'));

          if (variable_get('user_register', 1)) {
            $items[] = l(t('Create new account'), 'user/register', array('title' => t('Create a new user account.')));
          }
          $items[] = l(t('Request new password'), 'user/password', array('title' => t('Request new password via e-mail.')));

          $output .= theme('item_list', $items);

          $block['subject'] = t('User login');
          $block['content'] = $output;
        }
        return $block;

      case 1:
        if ($menu = theme('menu_tree')) {
           $block['subject'] = $user->uid ? $user->name : t('Navigation');
           $block['content'] = '<div class="menu">'. $menu .'</div>';
        }
        return $block;

      case 2:
        if (user_access('access content')) {
          $result = db_query_range('SELECT uid, name FROM {users} WHERE status != 0 ORDER BY created DESC', 0, 5);
          while ($account = db_fetch_object($result)) {
            $items[] = $account;
          }
          $output = theme('user_list', $items);

          $block['subject'] = t('Who\'s new');
          $block['content'] = $output;
        }
        return $block;

      case 3:
        if (user_access('access content')) {
          // Count users with activity in the past defined period.
          $time_period = variable_get('user_block_seconds_online', 2700);

          // Perform database queries to gather online user lists.
          $guests = db_fetch_object(db_query('SELECT COUNT(sid) AS count FROM {sessions} WHERE timestamp >= %d AND uid = 0', time() - $time_period));
          $users = db_query('SELECT uid, name, access FROM {users} WHERE access >= %d AND uid != 0 ORDER BY access DESC', time() - $time_period);
          $total_users = db_num_rows($users);

          // Format the output with proper grammar.
          if ($total_users == 1 && $guests->count == 1) {
            $output = t('There is currently %members and %visitors online.', array('%members' => format_plural($total_users, '1 user', '%count users'), '%visitors' => format_plural($guests->count, '1 guest', '%count guests')));
          }
          else {
            $output = t('There are currently %members and %visitors online.', array('%members' => format_plural($total_users, '1 user', '%count users'), '%visitors' => format_plural($guests->count, '1 guest', '%count guests')));
          }

          // Display a list of currently online users.
          $max_users = variable_get('user_block_max_list_count', 10);
          $items = array();

          while ($max_users-- && $account = db_fetch_object($users)) {
            $items[] = $account;
          }

          if ($items) {
            $output .= theme('user_list', $items, t('Online users'));
          }

          $block['subject'] = t('Who\'s online');
          $block['content'] = $output;
        }
        return $block;
    }
  }
}

function theme_user_picture($account) {
  if (variable_get('user_pictures', 0)) {
    if ($account->picture && file_exists($account->picture)) {
      $picture = file_create_url($account->picture);
    }
    else if (variable_get('user_picture_default', '')) {
      $picture = variable_get('user_picture_default', '');
    }

    if ($picture) {
      $alt = t('%user\'s picture', array('%user' => $account->name ? $account->name : variable_get('anonymous', 'Anonymous')));
      $picture = theme('image', $picture, $alt, $alt, '', false);
      if ($account->uid) {
        $picture = l($picture, "user/$account->uid", array('title' => t('View user profile.')), NULL, NULL, FALSE, TRUE);
      }

      return "<div class=\"picture\">$picture</div>";
    }
  }
}

function theme_user_profile($account, $fields) {
  $output = "<div class=\"profile\">\n";
  $output .= theme('user_picture', $account);
  foreach ($fields as $category => $value) {
    $output .= theme('box', $category, $value);
  }
  $output .= "</div>\n";

  return $output;
}

/**
 * Make a list of users.
 * @param $items an array with user objects. Should contain at least the name and uid
 *
 * @ingroup themeable
 */
function theme_user_list($users, $title = NULL) {
  foreach ($users as $user) {
    $items[] = theme('username', $user);
  }
  return theme('item_list', $items, $title);
}

/**
 * Implementation of hook_menu().
 */
function user_menu($may_cache) {
  global $user;

  $items = array();

  $admin_access = user_access('administer users');
  // users should always be allowed to see their own user page
  $view_access = (user_access('access user profiles') || ($user->uid == arg(1)));

  if ($may_cache) {
    $items[] = array('path' => 'user', 'title' => t('user account'),
      'callback' => 'user_page', 'access' => TRUE, 'type' => MENU_CALLBACK);

    $items[] = array('path' => 'user/autocomplete', 'title' => t('user autocomplete'),
      'callback' => 'user_autocomplete', 'access' => $view_access, 'type' => MENU_CALLBACK);

    //registration and login pages.
    $items[] = array('path' => 'user/login', 'title' => t('log in'),
      'type' => MENU_DEFAULT_LOCAL_TASK);
    $items[] = array('path' => 'user/register', 'title' => t('register'),
      'callback' => 'user_page', 'access' => $user->uid == 0 && variable_get('user_register', 1), 'type' => MENU_LOCAL_TASK);
    $items[] = array('path' => 'user/password', 'title' => t('request new password'),
      'callback' => 'user_pass', 'access' => $user->uid == 0, 'type' => MENU_LOCAL_TASK);
    $items[] = array('path' => 'user/reset', 'title' => t('reset password'),
      'callback' => 'user_pass_reset', 'access' => $user->uid == 0, 'type' => MENU_CALLBACK);
    $items[] = array('path' => 'user/help', 'title' => t('help'),
      'callback' => 'user_help_page', 'type' => MENU_CALLBACK);

    //admin pages
    $items[] = array('path' => 'admin/user', 'title' => t('users'),
      'callback' => 'user_admin', 'access' => $admin_access);
    $items[] = array('path' => 'admin/user/list', 'title' => t('list'),
      'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
    $items[] = array('path' => 'admin/user/create', 'title' => t('add user'),
      'callback' => 'user_admin', 'access' => $admin_access,
      'type' => MENU_LOCAL_TASK);
    $items[] = array('path' => 'admin/settings/user', 'title' => t('users'),
      'callback' => 'user_configure', 'access' => $admin_access);
    $items[] = array('path' => 'admin/access', 'title' => t('access control'),
      'callback' => 'user_admin_perm', 'access' => $admin_access);
    $items[] = array('path' => 'admin/access/permissions', 'title' => t('permissions'),
      'callback' => 'user_admin_perm', 'access' => $admin_access,
      'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
    $items[] = array('path' => 'admin/access/roles', 'title' => t('roles'),
      'callback' => 'user_admin_role', 'access' => $admin_access,
      'type' => MENU_LOCAL_TASK);
    $items[] = array('path' => 'admin/access/roles/edit', 'title' => t('edit role'),
      'callback' => 'user_admin_role', 'access' => $admin_access,
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'admin/access/rules', 'title' => t('access rules'),
      'callback' => 'user_admin_access', 'access' => $admin_access,
      'type' => MENU_LOCAL_TASK, 'weight' => 10);
    $items[] = array('path' => 'admin/access/rules/list', 'title' => t('list'),
      'access' => $admin_access, 'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
    $items[] = array('path' => 'admin/access/rules/add', 'title' => t('add rule'),
      'callback' => 'user_admin_access_add', 'access' => $admin_access,
      'type' => MENU_LOCAL_TASK);
    $items[] = array('path' => 'admin/access/rules/check', 'title' => t('check rules'),
      'callback' => 'user_admin_access_check', 'access' => $admin_access,
      'type' => MENU_LOCAL_TASK);
    $items[] = array('path' => 'admin/access/rules/edit', 'title' => t('edit rule'),
      'callback' => 'user_admin_access_edit', 'access' => $admin_access,
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'admin/access/rules/delete', 'title' => t('delete rule'),
      'callback' => 'user_admin_access_delete', 'access' => $admin_access,
      'type' => MENU_CALLBACK);

    if (module_exist('search')) {
      $items[] = array('path' => 'admin/user/search', 'title' => t('search'),
        'callback' => 'user_admin', 'access' => $admin_access,
        'type' => MENU_LOCAL_TASK);
    }

    //Your personal page
    if ($user->uid) {
      $items[] = array('path' => 'user/'. $user->uid, 'title' => t('my account'),
        'callback' => 'user_page', 'access' => TRUE,
        'type' => MENU_DYNAMIC_ITEM);
    }

    $items[] = array('path' => 'logout', 'title' => t('log out'),
      'access' => $user->uid != 0,
      'callback' => 'user_logout',
      'weight' => 10);
  }
  else {
    if (arg(0) == 'user' && is_numeric(arg(1))) {
      $items[] = array('path' => 'user/'. arg(1), 'title' => t('user'),
        'type' => MENU_CALLBACK, 'callback' => 'user_page', 'access' => $view_access);
      $items[] = array('path' => 'user/'. arg(1) .'/view', 'title' => t('view'),
        'access' => $view_access, 'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
      $items[] = array('path' => 'user/'. arg(1) .'/edit', 'title' => t('edit'),
        'callback' => 'user_edit', 'access' => $admin_access || $user->uid == arg(1),
        'type' => MENU_LOCAL_TASK);
      $items[] = array('path' => 'user/'. arg(1) .'/delete', 'title' => t('delete'),
        'callback' => 'user_edit', 'access' => $admin_access,
        'type' => MENU_CALLBACK);

      if (arg(2) == 'edit') {
        if (($categories = _user_categories()) && (count($categories) > 1)) {
          foreach ($categories as $key => $category) {
            $items[] = array(
              'path' => 'user/'. arg(1) .'/edit/'. $category['name'],
              'title' => $category['title'],
              'type' => $category['name'] == 'account' ? MENU_DEFAULT_LOCAL_TASK : MENU_LOCAL_TASK,
              'weight' => $category['weight'],
              'access' => ($admin_access || $user->uid == arg(1)));
          }
        }
      }
    }
  }

  return $items;
}

/**
 * Called by authentication modules in order to edit/view their authmap information.
 */
function user_get_authname($account, $module) {
  $result = db_query("SELECT authname FROM {authmap} WHERE uid = %d AND module = '%s'", $account->uid, $module);
  return db_result($result);
}

/**
 * Accepts an user object, $account, or a DA name and returns an associative
 * array of modules and DA names. Called at external login.
 */
function user_get_authmaps($authname = NULL) {
  $result = db_query("SELECT authname, module FROM {authmap} WHERE authname = '%s'", $authname);
  if (db_num_rows($result) > 0) {
    while ($authmap = db_fetch_object($result)) {
      $authmaps[$authmap->module] = $authmap->authname;
    }
    return $authmaps;
  }
  else {
    return 0;
  }
}

function user_set_authmaps($account, $authmaps) {
  foreach ($authmaps as $key => $value) {
    $module = explode('_', $key, 2);
    if ($value) {
      db_query("UPDATE {authmap} SET authname = '%s' WHERE uid = %d AND module = '%s'", $value, $account->uid, $module['1']);
      if (!db_affected_rows()) {
        db_query("INSERT INTO {authmap} (authname, uid, module) VALUES ('%s', %d, '%s')", $value, $account->uid, $module[1]);
      }
    }
    else {
      db_query("DELETE FROM {authmap} WHERE uid = %d AND module = '%s'", $account->uid, $module['1']);
    }
  }
}

function user_auth_help_links() {
  $links = array();
  foreach (module_list() as $module) {
    if (module_hook($module, 'auth')) {
      $links[] = l(module_invoke($module, 'info', 'name'), "user/help#$module");
    }
  }
  return $links;
}

/*** User features *********************************************************/

function user_login($edit = array(), $msg = '') {
  global $user, $base_url;

  // If we are already logged on, go to the user page instead.
  if ($user->uid) {
    drupal_goto('user');
  }

  if (isset($edit['name'])) {
    if (user_is_blocked($edit['name'])) {
      // blocked in user administration
      $error = t('The username %name has been blocked.', array('%name' => theme('placeholder', $edit['name'])));
    }
    else if (drupal_is_denied('user', $edit['name'])) {
      // denied by access controls
      $error = t('The name %name is a reserved username.', array('%name' => theme('placeholder', $edit['name'])));
    }
    else if ($edit['pass']) {

      if (!$user->uid) {
        $user = user_authenticate($edit['name'], trim($edit['pass']));
      }

      if ($user->uid) {
        watchdog('user', t('Session opened for %name.', array('%name' => theme('placeholder', $user->name))));

        // Update the user table timestamp noting user has logged in.
        db_query("UPDATE {users} SET login = '%d' WHERE uid = '%s'", time(), $user->uid);

        user_module_invoke('login', $edit, $user);

        // Redirect the user to the page he logged on from.
        drupal_goto();
      }
      else {
        if (!$error) {
          $error = t('Sorry. Unrecognized username or password.') .' '. l(t('Have you forgotten your password?'), 'user/password');
        }
        watchdog('user', t('Login attempt failed for %user: %error.', array('%user' => theme('placeholder', $edit['name']), '%error' => theme('placeholder', $error))));
      }
    }
  }

  // Display error message (if any):
  if ($error) {
    drupal_set_message($error, 'error');
  }

  // Display login form:
  if ($msg) {
    $output .= "<p>$msg</p>";
  }
  if (count(user_auth_help_links()) > 0) {
    $output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64, t('Enter your %s username, or an ID from one of our affiliates: %a.', array('%s' => variable_get('site_name', 'local'), '%a' => implode(', ', user_auth_help_links()))));
  }
  else {
    $output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64, t('Enter your %s username.', array('%s' => variable_get('site_name', 'local'))));
  }
  $output .= form_password(t('Password'), 'pass', $pass, 30, 64, t('Enter the password that accompanies your username.'));
  $output .= form_submit(t('Log in'));

  return form($output, 'post', url('user/login', drupal_get_destination()));
}

function user_authenticate($name, $pass) {
  global $user;

  // Try to log in the user locally:
  $user = user_load(array('name' => $name, 'pass' => $pass, 'status' => 1));

  // Strip name and server from ID:
  if ($server = strrchr($name, '@')) {
    $name = substr($name, 0, strlen($name) - strlen($server));
    $server = substr($server, 1);
  }

  // When possible, determine corresponding external auth source. Invoke
  // source, and log in user if successful:
  if (!$user->uid && $server && $result = user_get_authmaps("$name@$server")) {
    if (module_invoke(key($result), 'auth', $name, $pass, $server)) {
      $user = user_external_load("$name@$server");
      watchdog('user', t('External load by %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', key($result)))));
    }
    else {
      $error = t('Invalid password for %s.', array('%s' => theme('placeholder', $name .'@'. $server)));
    }
  }

  // Try each external authentication source in series. Register user if
  // successful.
  else if (!$user->uid && $server) {
    foreach (module_list() as $module) {
      if (module_hook($module, 'auth')) {
        if (module_invoke($module, 'auth', $name, $pass, $server)) {
          if (variable_get('user_register', 1) == 1) {
            $account = user_load(array('name' => "$name@$server"));
            if (!$account->uid) { // Register this new user.
              $user = user_save('', array('name' => "$name@$server", 'pass' => user_password(), 'init' => "$name@$server", 'status' => 1, "authname_$module" => "$name@$server", 'roles' => array(_user_authenticated_id())));
              watchdog('user', t('New external user: %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', $module))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
              break;
            }
          }
        }
      }
    }
  }
  return $user;
}

function _user_authenticated_id() {
  return db_result(db_query("SELECT rid FROM {role} WHERE name = 'authenticated user'"));
}

/**
 * Menu callback; logs the current user out, and redirects to the home page.
 */
function user_logout() {
  global $user;

  watchdog('user', t('Session closed for %name.', array('%name' => theme('placeholder', $user->name))));

  // Destroy the current session:
  session_destroy();
  module_invoke_all('user', 'logout', NULL, $user);
  unset($user);

  drupal_goto();
}

function user_pass() {
  global $base_url;
  $edit = $_POST['edit'];

  if ($edit['name'] && !($account = user_load(array('name' => $edit['name'], 'status' => 1)))) {
    form_set_error('name', t('Sorry. The username %name is not recognized.', array('%name' => theme('placeholder', $edit['name']))));
  }
  else if ($edit['mail'] && !($account = user_load(array('mail' => $edit['mail'], 'status' => 1)))) {
    form_set_error('mail', t('Sorry. The e-mail address %email is not recognized.', array('%email' => theme('placeholder', $edit['mail']))));
  }
  if ($account) {
    $from = variable_get('site_mail', ini_get('sendmail_from'));

    // Mail one time login URL and instructions.
    $variables = array('%username' => $account->name, '%site' => variable_get('site_name', 'drupal'), '%login_url' => user_pass_reset_url($account), '%uri' => $base_url, '%uri_brief' => substr($base_url, strlen('http://')), '%mailto' => $account->mail, '%date' => format_date(time()), '%login_uri' => url('user', NULL, NULL, TRUE), '%edit_uri' => url('user/'. $account->uid .'/edit', NULL, NULL, TRUE));
    $subject = _user_mail_text('pass_subject', $variables);
    $body = _user_mail_text('pass_body', $variables);
    $headers = "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from";
    $mail_success = user_mail($account->mail, $subject, $body, $headers);

    if ($mail_success) {
      watchdog('user', t('Password reset instructions mailed to %name at %email.', array('%name' => '<em>'. $account->name .'</em>', '%email' => '<em>'. $account->mail .'</em>')));
      drupal_set_message(t('Further instructions have been sent to your e-mail address.'));
    }
    else {
      watchdog('user', t('Error mailing password reset instructions to %name at %email.', array('%name' => theme('placeholder', $account->name), '%email' => theme('placeholder', $account->mail))), WATCHDOG_ERROR);
      drupal_set_message(t('Unable to send mail. Please contact the site admin.'));
    }
    drupal_goto('user');
  }
  else {
    if ($edit) {
      drupal_set_message(t('You must provide either a username or e-mail address.'), 'error');
    }
    // Display form:
    $output = '<p>'. t('Enter your username <strong><em>or</em></strong> your e-mail address.') .'</p>';
    $output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64);
    $output .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 64);
    $output .= form_submit(t('E-mail new password'));
    return form($output);
  }
}

/**
 * Menu callback; process one time login URL, and redirects to the user page on success.
 */
function user_pass_reset($uid, $timestamp, $hashed_pass) {
  global $user;
  // Time out, in seconds, until login URL expires. 24 hours = 86400 seconds.
  $timeout = 86400;
  $current = time();
  // Some redundant checks for extra security ?
  if ($timestamp < $current && is_numeric($uid) && $account = user_load(array('uid' => $uid, 'status' => 1)) ) {
    // No time out for first time login.
    if ($account->login && $current - $timestamp > $timeout) {
      drupal_set_message(t('You have tried to use a one time login URL which has expired. Please request a new one using the form below.'));
      drupal_goto('user/password');
    }
    if ($account->uid && !$user->uid && !empty($account) && $timestamp > $account->login && $timestamp < $current &&
        $hashed_pass == user_pass_rehash($account->pass, $timestamp, $account->login)) {
      watchdog('user', t('One time login URL used for %name with timestamp %timestamp.', array('%name' => "<em>$account->name</em>", '%timestamp' => $timestamp)));
      // Update the user table noting user has logged in.
      // And this also makes this hashed password a one-time-only login.
      db_query("UPDATE {users} SET login = '%d' WHERE uid = %d", time(), $account->uid);
      // Now we can set the new user.
      $user = $account;
      // And proceed with normal login, going to user page.
      user_module_invoke('login', $edit, $user);
      drupal_set_message(t("You have used a one-time login, which won't be valid anymore."));
      drupal_set_message(t('Please change your password.'));
      drupal_goto('user/'. $user->uid .'/edit');
    }
  }
  // Deny access, no more clues.
  // Everything will be in the watchdog's URL for the administrator to check.
  drupal_access_denied();
}

function user_pass_reset_url($account){
  $timestamp = time();
  return url("user/reset/$account->uid/$timestamp/".user_pass_rehash($account->pass, $timestamp, $account->login), NULL, NULL, TRUE);
}

function user_pass_rehash($password, $timestamp, $login){
  return md5($timestamp . $password . $login);
}

function user_register($edit = array()) {
  global $user, $base_url;

  // If we are already logged on, go to the user page instead.
  if ($user->uid) {
    drupal_goto('user/'. $user->uid);
  }

  if ($edit) {
    user_module_invoke('validate', $edit, $edit, 'account');

    if (!form_get_errors()) {
      $from = variable_get('site_mail', ini_get('sendmail_from'));
      $pass = user_password();

      // TODO: Is this necessary? Won't session_write() replicate this?
      unset($edit['session']);
      if (array_intersect(array_keys($edit), array('uid', 'roles', 'init', 'session', 'status'))) {
        watchdog('security', t('Detected malicious attempt to alter protected user fields.'), WATCHDOG_WARNING);
        drupal_goto('user/register');
      }
      $account = user_save('', array_merge($edit, array('pass' => $pass, 'init' => $edit['mail'], 'roles' => array(_user_authenticated_id()), 'status' => (variable_get('user_register', 1) == 1 ? 1 : 0))));
      watchdog('user', t('New user: %name %email.', array('%name' => theme('placeholder', $edit['name']), '%email' => theme('placeholder', '<'. $edit['mail'] .'>'))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $account->uid .'/edit'));

      $variables = array('%username' => $edit['name'], '%site' => variable_get('site_name', 'drupal'), '%password' => $pass, '%uri' => $base_url, '%uri_brief' => substr($base_url, strlen('http://')), '%mailto' => $edit['mail'], '%date' => format_date(time()), '%login_uri' => url('user', NULL, NULL, TRUE), '%edit_uri' => url('user/'. $account->uid .'/edit', NULL, NULL, TRUE), '%login_url' => user_pass_reset_url($account));

      // The first user may login immediately, and receives a customized welcome e-mail.
      if ($account->uid == 1) {
        user_mail($edit['mail'], t('drupal user account details for %s', array('%s' => $edit['name'])), strtr(t("%username,\n\nYou may now login to %uri using the following username and password:\n\n  username: %username\n  password: %password\n\n%edit_uri\n\n--drupal"), $variables), "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
        // This should not be t()'ed. No point as its only shown once in the sites lifetime, and it would be bad to store the password.
        $output .= "<p>Welcome to Drupal. You are user #1, which gives you full and immediate access.  All future registrants will receive their passwords via e-mail, so please configure your e-mail settings using the Administration pages.</p><p> Your password is <strong>$pass</strong>. You may change your password on the next page.</p><p>Please login below.</p>";
        $output .= form_hidden('destination', 'user/'. $account->uid .'/edit');
        $output .= form_hidden('name', $account->name);
        $output .= form_hidden('pass', $pass);
        $output .= form_submit(t('Log in'));
        return form($output);
      }
      else {
        if ($account->status) {
          // Create new user account, no administrator approval required.
          $subject = _user_mail_text('welcome_subject', $variables);
          $body = _user_mail_text('welcome_body', $variables);
          user_mail($edit['mail'], $subject, $body, "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
          return t('Your password and further instructions have been sent to your e-mail address.');
        }
        else {
          // Create new user account, administrator approval required.
          $subject = _user_mail_text('approval_subject', $variables);
          $body = _user_mail_text('approval_body', $variables);

          user_mail($edit['mail'], $subject, $body, "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
          user_mail(variable_get('site_mail', ini_get('sendmail_from')), $subject, t("%u has applied for an account.\n\n%uri", array('%u' => $account->name, '%uri' => url("user/$account->uid/edit", NULL, NULL, TRUE))), "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from");
          return t('Thank you for applying for an account. Your account is currently pending approval by the site administrator.<br />In the meantime, your password and further instructions have been sent to your e-mail address.');
        }
      }
    }
  }

  // Display the registration form.
  $output .= variable_get('user_registration_help', '');
  $affiliates = user_auth_help_links();
  if (count($affiliates) > 0) {
    $affiliates = implode(', ', $affiliates);
    $output .= '<p>'. t('Note: if you have an account with one of our affiliates (%s), you may <a href="%login_uri">login now</a> instead of registering.', array('%s' => $affiliates, '%login_uri' => url('user'))) .'</p>';
  }
  $default = form_textfield(t('Username'), 'name', $edit['name'], 30, 64, t('Your full name or your preferred username; only letters, numbers and spaces are allowed.'), NULL, TRUE);
  $default .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 64, t('A password and instructions will be sent to this e-mail address, so make sure it is accurate.'), NULL, TRUE);
  $extra = _user_forms($edit, $account, $category, 'register');
  // Only display form_group around default fields if there are other groups.
  if ($extra) {
    $output .= form_group(t('Account information'), $default);
    $output .= $extra;
  }
  else {
    $output .= $default;
  }

  $output .= form_submit(t('Create new account'));

  return form($output);
}

function user_edit_form($uid, $edit) {
  // Account information:
  $group  = form_textfield(t('Username'), 'name', $edit['name'], 60, 55, t('Your full name or your preferred username: only letters, numbers and spaces are allowed.'), NULL, TRUE);
  $group .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 60, 55, t('Insert a valid e-mail address.  All e-mails from the system will be sent to this address. The e-mail address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by e-mail.'), NULL, TRUE);
  $group .= form_item(t('Password'), '<input type="password" class="form-password" name="edit[pass1]" size="12" maxlength="24" /> <input type="password" class="form-password" name="edit[pass2]" size="12" maxlength="24" />', t('Enter your new password twice if you want to change your current password, or leave it blank if you are happy with your current password.'), NULL, TRUE);

  if (user_access('administer users')) {
    $group .= form_radios(t('Status'), 'status', $edit['status'], array(t('Blocked'), t('Active')));
    $group .= form_checkboxes(t('Roles'), 'roles', array_keys($edit['roles']), user_roles(1), t('Select at least one role.  The user receives the combined permissions of all of the selected roles.'), NULL, TRUE);
  }

  $data[] = array('title' => t('Account information'), 'data' => $group, 'weight' => 0);

  // Picture/avatar:
  if (variable_get('user_pictures', 0)) {
    $group = '';
    if ($edit['picture'] && ($picture = theme('user_picture', array2object($edit)))) {
      $group .= $picture;
      $group .= form_checkbox(t('Delete picture'), 'picture_delete', 1, 0, t('Check this box to delete your current picture.'));
    }
    $group .= form_file(t('Upload picture'), 'picture', 48, t('Your virtual face or picture.  Maximum dimensions are %dimensions and the maximum size is %size kB.', array('%dimensions' => variable_get('user_picture_dimensions', '85x85'), '%size' => variable_get('user_picture_file_size', '30'))) .' '. variable_get('user_picture_guidelines', ''));
    $data[] = array('title' => t('Picture'), 'data' => $group, 'weight' => 1);
  }

  return $data;
}

function user_edit_validate($uid, &$edit) {
  // Validate the username:
  if ($error = user_validate_name($edit['name'])) {
    form_set_error('name', $error);
  }
  else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(name) = LOWER('%s')", $uid, $edit['name'])) > 0) {
    form_set_error('name', t('The name %name is already taken.', array('%name' => theme('placeholder', $edit['name']))));
  }
  else if (drupal_is_denied('user', $edit['name'])) {
    form_set_error('name', t('The name %name has been denied access.', array('%name' => theme('placeholder', $edit['name']))));
  }

  // Validate the e-mail address:
  if ($error = user_validate_mail($edit['mail'])) {
    form_set_error('mail', $error);
  }
  else if (db_num_rows(db_query("SELECT uid FROM {users} WHERE uid != %d AND LOWER(mail) = LOWER('%s')", $uid, $edit['mail'])) > 0) {
    form_set_error('mail', t('The e-mail address %email is already taken.', array('%email' => theme('placeholder', $edit['mail']))));
  }
  else if (drupal_is_denied('mail', $edit['mail'])) {
    form_set_error('mail', t('The e-mail address %email has been denied access.', array('%email' => theme('placeholder', $edit['mail']))));
  }

  // Validate the user roles:
  if (user_access('administer users')) {
    if (!$edit['roles']) {
      form_set_error('roles', t('You must select at least one role.'));
      $edit['roles'] = array();
    }
    else {
      // Before form submission, $edit['roles'] contains ('role id' => 'role name') tuples.
      // After form submission, $edit['roles'] contains ('number' => 'role id') tuples.  We
      // flip the array to always have the role id's in the keys.
      $edit['roles'] = array_flip($edit['roles']);
    }
  }

  // If required, validate the uploaded picture.
  if ($file = file_check_upload('picture')) {
    $user = user_load(array('uid' => $uid));
    user_validate_picture($file, $edit, $user);
  }
  // Delete picture if requested, and if no replacement picture was given.
  else if ($edit['picture_delete']) {
    $user = user_load(array('uid' => $uid));
    if ($user->picture && file_exists($user->picture)) {
      file_delete($user->picture);
    }
    $edit['picture'] = '';
  }

  // If required, check that proposed passwords match.  If so, add the new password to $edit.
  if ($edit['pass1']) {
    $edit['pass1'] = trim($edit['pass1']);
    $edit['pass2'] = trim($edit['pass2']);
    if ($edit['pass1'] == $edit['pass2']) {
      $edit['pass'] = $edit['pass1'];
    }
    else {
      form_set_error('pass2', t('The specified passwords do not match.'));
    }
  }
  unset($edit['pass1'], $edit['pass2']);

  return $edit;
}

function user_edit($category = 'account') {
  global $user;

  $account = user_load(array('uid' => arg(1)));
  $edit = $_POST['op'] ? $_POST['edit'] : object2array($account);

  if ($_POST['op'] == t('Submit')) {
    user_module_invoke('validate', $edit, $account, $category);

    if (!form_get_errors()) {
      // Validate input to ensure that non-privileged users can't alter protected data.
      if (!user_access('administer users') && array_intersect(array_keys($edit), array('uid', 'roles', 'init', 'session'))) {
        watchdog('security', t('Detected malicious attempt to alter protected user fields.'), WATCHDOG_WARNING);
      }
      else {
        user_save($account, $edit, $category);
        // Delete that user's menu cache.
        cache_clear_all('menu:'. $account->uid, TRUE);
        drupal_set_message(t('The changes have been saved.'));
        drupal_goto("user/$account->uid");
      }
    }
  }
  else if (arg(2) == 'delete') {
    if ($edit['confirm']) {
      db_query('DELETE FROM {users} WHERE uid = %d', $account->uid);
      db_query('DELETE FROM {users_roles} WHERE uid = %d', $account->uid);
      db_query('DELETE FROM {authmap} WHERE uid = %d', $account->uid);
      drupal_set_message(t('The account has been deleted.'));
      module_invoke_all('user', 'delete', $edit, $account);
      drupal_goto('admin/user');
    }
    else {
      $output = theme('confirm',
                      t('Are you sure you want to delete the account %name?', array('%name' => theme('placeholder', $account->name))),
                      'user/'. $account->uid,
                      t('Deleting a user will remove all their submissions as well. This action cannot be undone.'),
                      t('Delete'));
      return $output;
    }
  }
  else if ($_POST['op'] == t('Delete')) {
    // Note: we redirect from user/uid/edit to user/uid/delete to make the tabs disappear.
    drupal_goto("user/$account->uid/delete");
  }

  $output  = _user_forms($edit, $account, $category);
  $output .= form_submit(t('Submit'));
  if (user_access('administer users')) {
    $output .= form_submit(t('Delete'));
  }
  $output = form($output, 'post', 0, array('enctype' => 'multipart/form-data'));

  drupal_set_title($account->name);
  return $output;
}

function user_view($uid = 0) {
  global $user;

  if ($account = user_load(array('uid' => $uid, 'status' => 1))) {
    // Retrieve and merge all profile fields:
    $fields = array();
    foreach (module_list() as $module) {
      if ($data = module_invoke($module, 'user', 'view', '', $account)) {
        foreach ($data as $category => $content) {
          $fields[$category] .= $content;
        }
      }
    }

    drupal_set_title($account->name);
    return theme('user_profile', $account, $fields);
  }
  else {
    drupal_not_found();
  }
}

function user_page() {
  global $user;

  $edit = $_POST['edit'];
  $op = $_POST['op'];

  if (empty($op)) {
    $op = arg(2) ? arg(2) : arg(1);
  }

  switch ($op) {
    case t('Create new account'):
    case 'register':
      return user_register($edit);
      break;
    case t('Log in'):
    case 'login':
      return user_login($edit);
      break;
    default:
      if (!arg(1)) {
        if ($user->uid) {
          drupal_goto('user/'. $user->uid);
        }
        else {
          return user_login($edit);
        }
      }
      else {
        return user_view(arg(1));
      }
  }

}

/*** Administrative features ***********************************************/

function _user_mail_text($messageid, $variables = array()) {

  // Check if an admin setting overrides the default string.
  if ($admin_setting = variable_get('user_mail_' . $messageid, FALSE)) {
    return strtr($admin_setting, $variables);
  }
  // No override, return with default strings.
  else {
    switch ($messageid) {
      case 'welcome_subject':
        return t('Account details for %username at %site', $variables);
      case 'welcome_body':
        return t("%username,\n\nThank you for registering at %site. You may now log in to %login_uri using the following username and password:\n\nusername: %username\npassword: %password\n\nYou may also log in by clicking on this link or copying and pasting it in your browser:\n\n%login_url\n\nThis is a one-time login, so it can be used only once.\n\nAfter logging in, you will be redirected to %edit_uri so you can change your password.\n\nYour new %site membership also enables to you to login to other Drupal powered websites (e.g. http://www.drupal.org/) without registering. Just use the following Drupal ID and password:\n\nDrupal ID: %username@%uri_brief\npassword: %password\n\n\n--  %site team", $variables);
      case 'approval_subject':
        return t('Account details for %username at %site (pending admin approval)', $variables);
      case 'approval_body':
        return t("%username,\n\nThank you for registering at %site. Your application for an account is currently pending approval. Once it has been granted, you may log in to %login_uri using the following username and password:\n\nusername: %username\npassword: %password\n\nYou may also log in by clicking on this link or copying and pasting it in your browser:\n\n%login_url\n\nThis is a one-time login, so it can be used only once.\n\nAfter logging in, you may wish to change your password at %edit_uri\n\nYour new %site membership also enables to you to login to other Drupal powered websites (e.g. http://www.drop.org/) without registering. Just use the following Drupal ID and password:\n\nDrupal ID: %username@%uri_brief\npassword: %password\n\n\n--  %site team", $variables);
      case 'pass_subject':
        return t('Replacement login information for %username at %site', $variables);
      case 'pass_body':
        return t("%username,\n\nA request to reset the password for your account has been made at %site.\n\nYou may now log in to %uri_brief clicking on this link or copying and pasting it in your browser:\n\n%login_url\n\nThis is a one-time login, so it can be used only once. It expires after one day and nothing will happen if it's not used.\n\nAfter logging in, you will be redirected to %edit_uri so you can change your password.", $variables);
    }
  }
}

function user_configure_settings() {
  // User registration settings.
  $group = form_radios(t('Public registrations'), 'user_register', variable_get('user_register', 1), array(t('Only site administrators can create new user accounts.'), t('Visitors can create accounts and no administrator approval is required.'), t('Visitors can create accounts but administrator approval is required.')));
  $group .= form_textarea(t('User registration guidelines'), 'user_registration_help', variable_get('user_registration_help', ''), 60, 5, t('This text is displayed at the top of the user registration form.  It\'s useful for helping or instructing your users.'));
  $output = form_group(t('User registration settings'), $group);

  // User e-mail settings.
  $group = form_textfield(t('Subject of welcome e-mail'), 'user_mail_welcome_subject', _user_mail_text('welcome_subject'), 60, 180, t('Customize the subject of your welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri, %login_url.');
  $group .= form_textarea(t('Body of welcome e-mail'), 'user_mail_welcome_body', _user_mail_text('welcome_body'), 60, 15, t('Customize the body of the welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %login_uri, %edit_uri, %login_url.');
  $group .= form_textfield(t('Subject of welcome e-mail (awaiting admin approval)'), 'user_mail_approval_subject', _user_mail_text('approval_subject'), 50, 180, t('Customize the subject of your awaiting approval welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri, %login_url.');
  $group .= form_textarea(t('Body of welcome e-mail (awaiting admin approval)'), 'user_mail_approval_body', _user_mail_text('approval_body'), 60, 15, t('Customize the body of the awaiting approval welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %login_uri, %edit_uri, %login_url.');
  $group .= form_textfield(t('Subject of password recovery e-mail'), 'user_mail_pass_subject', _user_mail_text('pass_subject'), 60, 180, t('Customize the Subject of your forgotten password e-mail.') .' '. t('Available variables are:') .' %username, %site, %login_url, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri.');
  $group .= form_textarea(t('Body of password recovery e-mail'), 'user_mail_pass_body', _user_mail_text('pass_body'), 60, 15, t('Customize the body of the forgotten password e-mail.') .' '. t('Available variables are:') .' %username, %site, %login_url, %uri, %uri_brief, %mailto, %login_uri, %edit_uri.');
  $output .= form_group(t('User email settings'), $group);

  // If picture support is enabled, check whether the picture directory exists:
  if (variable_get('user_pictures', 0)) {
    file_check_directory(file_create_path(variable_get('user_picture_path', 'pictures')), 1, 'user_picture_path');
  }

  $group  = form_radios(t('Picture support'), 'user_pictures', variable_get('user_pictures', 0), array(t('Disabled'), t('Enabled')), t('Enable picture support.'));
  $group .= form_textfield(t('Picture image path'), 'user_picture_path', variable_get('user_picture_path', 'pictures'), 30, 255, t('Subdirectory in the directory "%dir" where pictures will be stored.', array('%dir' => variable_get('file_directory_path', 'files') .'/')));
  $group .= form_textfield(t('Default picture'), 'user_picture_default', variable_get('user_picture_default', ''), 30, 255, t('URL of picture to display for users with no custom picture selected. Leave blank for none.'));
  $group .= form_textfield(t('Picture maximum dimensions'), 'user_picture_dimensions', variable_get('user_picture_dimensions', '85x85'), 15, 10, t('Maximum dimensions for pictures.'));
  $group .= form_textfield(t('Picture maximum file size'), 'user_picture_file_size', variable_get('user_picture_file_size', '30'), 15, 10, t('Maximum file size for pictures, in kB.'));
  $group .= form_textarea(t('Picture guidelines'), 'user_picture_guidelines', variable_get('user_picture_guidelines', ''), 60, 5, t('This text is displayed at the picture upload form in addition to the default guidelines.  It\'s useful for helping or instructing your users.'));

  $output .= form_group(t('Pictures'), $group);

  return $output;
}

function user_admin_create($edit = array()) {

  if ($edit) {
    // Because the admin form doesn't have roles selection they need to be set to validate properly
    $edit['roles'] = array(_user_authenticated_id() => 'authenticated user');
    user_module_invoke('validate', $edit, $edit, 'account');

    if (!form_get_errors()) {
      watchdog('user', t('New user: %name %email.', array('%name' => theme('placeholder', $edit['name']), '%email' => theme('placeholder', '<'. $edit['mail'] .'>'))));

      user_save('', array('name' => $edit['name'], 'pass' => $edit['pass'], 'init' => $edit['mail'], 'mail' => $edit['mail'], 'roles' => $edit['roles'], 'status' => 1));

      drupal_set_message(t('Created a new user account. No e-mail has been sent.'));

      drupal_goto('admin/user');
    }
  }

  $output  = form_textfield(t('Username'), 'name', $edit['name'], 30, 55, t('Provide the username of the new account.'), NULL, TRUE);
  $output .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 55, t('Provide the e-mail address associated with the new account.'), NULL, TRUE);
  $output .= form_password(t('Password'), 'pass', $edit['pass'], 30, 55, t('Provide a password for the new account.'), NULL, TRUE);
  $output .= form_submit(t('Create account'));

  $output = form_group(t('Create new user account'), $output);

  return form($output);
}

/**
 * Menu callback: check an access rule
 */
function user_admin_access_check() {
  if ($_POST['op']) {
    $op = $_POST['op'];
  }
  $edit = $_POST['edit'];

  if ($op) {
    if (drupal_is_denied($edit['type'], $edit['test'])) {
      drupal_set_message(t('%test is not allowed.', array('%test' => theme('placeholder', $edit['test']))));
    }
    else {
      drupal_set_message(t('%test is allowed.', array('%test' => theme('placeholder', $edit['test']))));
    }
  }

  $form = form_textfield('', 'test', '', 30, 64, t('Enter a username to check if it will be denied or allowed.'));
  $form .= form_hidden('type', 'user');
  $form .= form_submit(t('Check username'));
  $output .= form_group(t('Username'), form($form));

  $form = form_textfield('', 'test', '', 30, 64, t('Enter an e-mail address to check if it will be denied or allowed.'));
  $form .= form_hidden('type', 'mail');
  $form .= form_submit(t('Check e-mail'));
  $output .= form_group(t('E-mail'), form($form));

  $form = form_textfield('', 'test', '', 30, 64, t('Enter a host to check if it will be denied or allowed.'));
  $form .= form_hidden('type', 'host');
  $form .= form_submit(t('Check host'));
  $output .= form_group(t('Host'), form($form));

  return $output;
}

/**
 * Menu callback: add an access rule
 */
function user_admin_access_add($mask = NULL, $type = NULL) {
  if ($edit = $_POST['edit']) {
    if (!$edit['mask']) {
      form_set_error('mask', t('You must enter a mask.'));
    }
    else {
      $aid = db_next_id('{access}_aid');
      db_query("INSERT INTO {access} (aid, mask, type, status) VALUES ('%s', '%s', '%s', %d)", $aid, $edit['mask'], $edit['type'], $edit['status']);
      drupal_set_message(t('The access rule has been added.'));
      drupal_goto('admin/access/rules');
    }
  }
  else {
    $edit['mask'] = $mask;
    $edit['type'] = $type;
  }

  $form = _user_admin_access_form($edit);
  $form .= form_submit(t('Add rule'));

  return form($form, 'post', NULL, array('id' => 'access-rules'));
}

/**
 * Menu callback: delete an access rule
 */
function user_admin_access_delete($aid = 0) {
  if ($_POST['edit']['confirm']) {
    db_query('DELETE FROM {access} WHERE aid = %d', $aid);
    drupal_set_message(t('The access rule has been deleted.'));
    drupal_goto('admin/access/rules');
  }
  else {
    $access_types = array('user' => t('username'), 'mail' => t('e-mail'));
    $edit = db_fetch_object(db_query('SELECT aid, type, status, mask FROM {access} WHERE aid = %d', $aid));

    $output = theme('confirm',
                    t('Are you sure you want to delete the %type rule for %rule?', array('%type' => $access_types[$edit->type], '%rule' => theme('placeholder', $edit->mask))),
                    'admin/access/rules',
                    t('This action cannot be undone.'),
                    t('Delete'),
                    t('Cancel'),
                    $extra);
    return $output;
  }
}

/**
 * Menu callback: edit an access rule
 */
function user_admin_access_edit($aid = 0) {
  if ($edit = $_POST['edit']) {
    if (!$edit['mask']) {
      form_set_error('mask', t('You must enter a mask.'));
    }
    else {
      db_query("UPDATE {access} SET mask = '%s', type = '%s', status = '%s' WHERE aid = %d", $edit['mask'], $edit['type'], $edit['status'], $aid);
      drupal_set_message(t('The access rule has been saved.'));
      drupal_goto('admin/access/rules');
    }
  }
  else {
    $edit = db_fetch_array(db_query('SELECT aid, type, status, mask FROM {access} WHERE aid = %d', $aid));
  }
  $form = _user_admin_access_form($edit);
  $form .= form_submit(t('Save rule'));
  return form($form, 'post', NULL, array('id' => 'access-rules'));
}

function _user_admin_access_form($edit) {
  $output = '<div class="access-type">'. form_radios(t('Access type'), 'status', $edit['status'], array('1' => t('Allow'), '0' => t('Deny'))) .'</div>';
  $output .= '<div class="rule-type">'. form_radios(t('Rule type'), 'type', $edit['type'] ? $edit['type'] : 'user', array('user' => t('Username'), 'mail' => t('E-mail'), 'host' => t('Host'))) .'</div>';
  $output .= '<div class="mask">'. form_textfield(t('Mask'), 'mask', $edit['mask'], 30, 64, '%: '. t('Matches any number of characters, even zero characters') .'.<br />_: '. t('Matches exactly one character.'), NULL, TRUE) .'</div>';

  return $output;
}

/**
 * Menu callback: list all access rules
 */
function user_admin_access() {
  $header = array(array('data' => t('Access type'), 'field' => 'status'), array('data' => t('Rule type'), 'field' => 'type'), array('data' =>t('Mask'), 'field' => 'mask'), array('data' => t('Operations'), 'colspan' => 2));
  $result = db_query("SELECT aid, type, status, mask FROM {access}". tablesort_sql($header));
  $access_types = array('user' => t('username'), 'mail' => t('e-mail'), 'host' => t('host'));
  $rows = array();
  while ($rule = db_fetch_object($result)) {
    $rows[] = array($rule->status ? t('allow') : t('deny'), $access_types[$rule->type], $rule->mask, l(t('edit'), 'admin/access/rules/edit/'. $rule->aid), l(t('delete'), 'admin/access/rules/delete/'. $rule->aid));
  }
  if (count($rows) == 0) {
    $rows[] = array(array('data' => '<em>'. t('There are currently no access rules.') .'</em>', 'colspan' => 5));
  }
  $output .= theme('table', $header, $rows);

  return $output;
}

function user_roles($membersonly = 0, $permission = 0) {
  $roles = array();

  if ($permission) {
    $result = db_query("SELECT r.* FROM {role} r INNER JOIN {permission} p ON r.rid = p.rid WHERE p.perm LIKE '%%%s%%' ORDER BY r.name", $permission);
  }
  else {
    $result = db_query('SELECT * FROM {role} ORDER BY name');
  }
  while ($role = db_fetch_object($result)) {
    if (!$membersonly || ($membersonly && $role->name != 'anonymous user')) {
      $roles[$role->rid] = $role->name;
    }
  }
  return $roles;
}

/**
 * Menu callback: administer permissions.
 */
function user_admin_perm() {
  $edit = $_POST['edit'];
  if ($edit) {
    // Save permissions:
    $result = db_query('SELECT * FROM {role}');
    while ($role = db_fetch_object($result)) {
      // Delete, so if we clear every checkbox we reset that role;
      // otherwise permissions are active and denied everywhere.
      db_query('DELETE FROM {permission} WHERE rid = %d', $role->rid);
      foreach ($edit[$role->rid] as $key => $value) {
        if (!$value) {
          unset($edit[$role->rid][$key]);
        }
      }
      if (count($edit[$role->rid])) {
        db_query("INSERT INTO {permission} (rid, perm) VALUES (%d, '%s')", $role->rid, implode(', ', array_keys($edit[$role->rid])));
      }
    }

    drupal_set_message(t('The changes have been saved.'));

    // Clear the cached pages and menus:
    menu_rebuild();

    drupal_goto($_GET['q']);
  }

  // Compile role array:
  $result = db_query('SELECT r.rid, p.perm FROM {role} r LEFT JOIN {permission} p ON r.rid = p.rid ORDER BY name');
  $roles = array();
  while ($role = db_fetch_object($result)) {
    $role_permissions[$role->rid] = $role->perm;
  }

  $result = db_query('SELECT rid, name FROM {role} ORDER BY name');
  $role_names = array();
  while ($role = db_fetch_object($result)) {
    $role_names[$role->rid] = $role->name;
  }

  // Render role/permission overview:
  $header = array_merge(array(t('Permission')), $role_names);

  foreach (module_list() as $module) {
    if ($permissions = module_invoke($module, 'perm')) {
      $rows[] = array(array('data' => t('%module module', array('%module' => $module)), 'class' => 'module', 'colspan' => count($role_names) + 1));
      asort($permissions);
      foreach ($permissions as $perm) {
        $row[] = array('data' => t($perm), 'class' => 'permission');
        foreach ($role_names as $rid => $name) {
          $row[] = form_checkbox('', "$rid][$perm", 1, strstr($role_permissions[$rid], $perm));
        }
        $rows[] = $row;
        unset($row);
      }
    }
  }

  $output = theme('table', $header, $rows, array('id' => 'permissions'));
  $output .= form_submit(t('Save permissions'));

  return form($output);
}

/**
 * Menu callback: administer roles.
 */
function user_admin_role() {
  $edit = $_POST['edit'];
  $op = $_POST['op'];
  $id = arg(4);

  if ($op == t('Save role')) {
    if ($edit['name']) {
      db_query("UPDATE {role} SET name = '%s' WHERE rid = %d", $edit['name'], $id);
      drupal_set_message(t('The changes have been saved.'));
    }
    else {
      form_set_error('name', t('You must specify a valid role name.'));
    }
  }
  else if ($op == t('Delete role')) {
    db_query('DELETE FROM {role} WHERE rid = %d', $id);
    db_query('DELETE FROM {permission} WHERE rid = %d', $id);

    // Update the users who have this role set:
    $result = db_query('SELECT DISTINCT(ur1.uid) FROM {users_roles} ur1 LEFT JOIN {users_roles} ur2 ON ur2.uid = ur1.uid WHERE ur1.rid = %d AND ur2.rid != ur1.rid', $id);
    $uid = array();

    while ($u = db_fetch_object($result)) {
      $uid[] = $u->uid;
    }

    if ($uid) {
      db_query('DELETE FROM {users_roles} WHERE rid = %d AND uid IN (%s)', $id, implode(', ', $uid));
    }

    // Users with only the deleted role are put back in the authenticated users pool.
    db_query('UPDATE {users_roles} SET rid = %d WHERE rid = %d', _user_authenticated_id(), $id);

    drupal_set_message(t('The role has been deleted.'));
    drupal_goto('admin/access/roles');
  }
  else if ($op == t('Add role')) {
    if ($edit['name']) {
      db_query("INSERT INTO {role} (name) VALUES ('%s')", $edit['name']);
      drupal_set_message(t('The role has been added.'));
      drupal_goto('admin/access/roles');
    }
    else {
      form_set_error('name', t('You must specify a valid role name.'));
    }
  }
  else if ($id) {
    // Display the role form.
    $role = db_fetch_object(db_query('SELECT * FROM {role} WHERE rid = %d', $id));

    $output .= form_textfield(t('Role name'), 'name', $role->name, 30, 64, t('The name for this role. Example: "moderator", "editorial board", "site architect".'));
    $output .= form_submit(t('Save role'));
    $output .= form_submit(t('Delete role'));

    $output = form($output);
  }

  if (!$output) {
    // Render the role overview.
    $result = db_query('SELECT * FROM {role} ORDER BY name');

    $header = array(t('Name'), t('Operations'));
    while ($role = db_fetch_object($result)) {
      if ($role->name != 'anonymous user' && $role->name != 'authenticated user') {
        $rows[] = array($role->name, l(t('edit'), 'admin/access/roles/edit/'. $role->rid));
      }
      else {
        $rows[] = array($role->name, '<span class="disabled">'. t('locked') .'</span>');
      }
    }
    $rows[] = array('<input type="text" size="32" maxlength="64" name="edit[name]" />', '<input type="submit" name="op" value="'. t('Add role') .'" />');

    $output = theme('table', $header, $rows);
    $output = form($output);
  }

  return $output;
}

function user_admin_account() {
  $header = array(
    array('data' => t('Username'), 'field' => 'u.name'),
    array('data' => t('Status'), 'field' => 'u.status'),
    array('data' => t('Member for'), 'field' => 'u.created', 'sort' => 'desc'),
    array('data' => t('Last access'), 'field' => 'u.access'),
    t('Operations')
  );
  $sql = 'SELECT u.uid, u.name, u.status, u.created, u.access FROM {users} u WHERE uid != 0';
  $sql .= tablesort_sql($header);
  $result = pager_query($sql, 50);

  $status = array(t('blocked'), t('active'));
  $destination = drupal_get_destination();
  while ($account = db_fetch_object($result)) {
    $rows[] = array(theme('username', $account),
                    $status[$account->status],
                    format_interval(time() - $account->created),
                    $account->access ? t('%time ago', array('%time' => format_interval(time() - $account->access))) : t('never'),
                    l(t('edit'), "user/$account->uid/edit", array(), $destination));
  }

  $pager = theme('pager', NULL, 50, 0, tablesort_pager());
  if (!empty($pager)) {
    $rows[] = array(array('data' => $pager, 'colspan' => '5'));
  }
  return theme('table', $header, $rows);
}

function user_configure() {
  $op = $_POST['op'];
  $edit = $_POST['edit'];

  if (empty($op)) {
    $op = arg(3);
  }

  if ($_POST) {
    system_settings_save();
  }
  $output = system_settings_form(user_configure_settings());

  return $output;
}

function user_admin() {
  $op = $_POST['op'];
  $edit = $_POST['edit'];

  if (empty($op)) {
    $op = arg(2);
  }

  switch ($op) {
    case 'search':
    case t('Search'):
      $output = search_form(url('admin/user/search'), $_POST['edit']['keys'], 'user') . search_data($_POST['edit']['keys'], 'user');
      break;
    case t('Create account'):
    case 'create':
      $output = user_admin_create($edit);
      break;
    default:
      $output = user_admin_account();
  }
  return $output;
}

/**
 * Implementation of hook_help().
 */
function user_help($section) {
  global $user;

  switch ($section) {
    case 'admin/user':
      return t('<p>Drupal allows users to register, login, logout, maintain user profiles, etc. No participant can use his own name to post content until he signs up for a user account.</p>');
    case 'admin/user/create':
    case 'admin/user/account/create':
      return t('<p>This web page allows the administrators to register a new users by hand. Note that you cannot have a user where either the e-mail address or the username match another user in the system.</p>');
    case strstr($section, 'admin/access/rules'):
      return t('<p>Set up username and e-mail address access rules for new accounts. If a username or email address for a new account matches any deny rule, but not an allow rule, then the new account will not be allowed to be created. A host rule is effective for every page view, not just registrations.</p>');
    case 'admin/access':
      return t('<p>Permissions let you control what users can do on your site.  Each user role (defined on the <a href="%role">user roles page</a>) has its own set of permissions. For example, you could give users classified as "Administrators" permission to "administer nodes" but deny this power to ordinary, "authenticated" users. You can use permissions to reveal new features to privileged users (those with subscriptions, for example). Permissions also allow trusted users to share the administrative burden of running a busy site.</p>', array('%role' => url('admin/access/roles')));
    case 'admin/access/roles':
      return t('<p>Roles allow you to fine tune the security and administration of drupal. A role defines a group of users that have certain privileges as defined in <a href="%permissions">user permissions</a>. Examples of roles include: anonymous user, authenticated user, moderator, administrator and so on. In this area you will define the <em>role names</em> of the various roles. To delete a role choose "edit".</p><p>By default, Drupal comes with two user roles:</p>
      <ul>
      <li>Anonymous user: this role is used for users that don\'t have a user account or that are not authenticated.</li>
      <li>Authenticated user: this role is assigned automatically to authenticated users. Most registered users will belong to this user role unless specified otherwise.</li>
      </ul>', array('%permissions' => url('admin/access/permissions')));
    case 'admin/user/search':
      return t('<p>Enter a simple pattern ("*" may be used as a wildcard match) to search for a username.  For example, one may search for "br" and Drupal might return "brian", "brad", and "brenda".</p>');
    case 'admin/modules#description':
      return t('Manages the user registration and login system.');
    case 'admin/user/configure':
    case 'admin/user/configure/settings':
      return t('<p>In order to use the full power of Drupal a visitor must sign up for an account. This page lets you setup how a user signs up, logs out, the guidelines from the system about user subscriptions, and the e-mails the system will send to the user.</p>');
    case 'user/help#user':
      $site = variable_get('site_name', 'this website');

      $output = t("
      <h3>Distributed authentication<a id=\"da\"></a></h3>
      <p>One of the more tedious moments in visiting a new website is filling out the registration form. Here at %site, you do not have to fill out a registration form if you are already a member of %help-links. This capability is called <em>distributed authentication</em>, and is unique to <a href=\"%drupal\">Drupal</a>, the software which powers %site.</p>
      <p>Distributed authentication enables a new user to input a username and password into the login box, and immediately be recognized, even if that user never registered at %site. This works because Drupal knows how to communicate with external registration databases. For example, lets say that new user 'Joe' is already a registered member of <a href=\"%delphi-forums\">Delphi Forums</a>. Drupal informs Joe on registration and login screens that he may login with his Delphi ID instead of registering with %site. Joe likes that idea, and logs in with a username of joe@remote.delphiforums.com and his usual Delphi password. Drupal then contacts the <em>remote.delphiforums.com</em> server behind the scenes (usually using <a href=\"%xml\">XML-RPC</a>, <a href=\"%http-post\">HTTP POST</a>, or <a href=\"%soap\">SOAP</a>) and asks: \"Is the password for user Joe correct?\".  If Delphi replies yes, then we create a new %site account for Joe and log him into it.  Joe may keep on logging into %site in the same manner, and he will always be logged into the same account.</p>", array('%help-links' => (implode(', ', user_auth_help_links())), '%site' => "<em>$site</em>", '%drupal' => 'http://www.drupal.org', '%delphi-forums' => 'http://www.delphiforums.com', '%xml' => 'http://www.xmlrpc.com', '%http-post' => 'http://www.w3.org/Protocols/', '%soap' => 'http://www.soapware.org'));

        foreach (module_list() as $module) {
          if (module_hook($module, 'auth')) {
            $output .= "<h4><a id=\"$module\"></a>". module_invoke($module, 'info', 'name') .'</h4>';
            $output .= module_invoke($module, 'help', "user/help#$module");
          }
        }

        return $output;
    case 'admin/help#user':
      $output = t("
      <h3>Introduction</h3>
      <p>Drupal offers a powerful access system that allows users to register, login, logout, maintain user profiles, etc. By using <a href=\"%user-role\">roles</a> you can setup fine grained <a href=\"%user-permission\">permissions</a> allowing each role to do only what you want them to. Each user is assigned to one or more roles. By default there are two roles \"anonymous\" - a user who has not logged in, and \"authorized\" a user who has signed up and who has been authorized. As anonymous users, participants suffer numerous disadvantages, for example they cannot sign their names to nodes, and their moderated posts beginning at a lower score.</p>
      <p>In contrast, those with a user account can use their own name or handle and are granted various privileges: the most important is probably the ability to moderate new submissions, to rate comments, and to fine-tune the site to their personal liking, with saved personal settings.  Drupal themes make fine tuning quite a pleasure.</p>
      <p>Registered users need to authenticate by supplying either a local username and password, or a remote username and password such as a <a href=\"%jabber\">Jabber ID</a>, <a href=\"%delphi-forums\">DelphiForums ID</a>, or one from a <a href=\"%drupal\">Drupal powered</a> website. See the <a href=\"%da-auth\">distributed authentication help</a> for more information on this innovative feature.
      The local username and password, hashed with Message Digest 5 (MD5), are stored in your database. When you enter a password it is also hashed with MD5 and compared with what is in the database. If the hashes match, the username and password are correct. Once a user authenticated session is started, and until that session is over, the user won't have to re-authenticate. To keep track of the individual sessions, Drupal relies on <a href=\"%php-sess\">PHP sessions</a>. A visitor accessing your website is assigned an unique ID, the so-called session ID, which is stored in a cookie. For security's sake, the cookie does not contain personal information but acts as a key to retrieve the information stored on your server. When a visitor accesses your site, Drupal will check whether a specific session ID has been sent with the request. If this is the case, the prior saved environment is recreated.</p>
      <h3>User preferences and profiles</h3><p>Each Drupal user has a profile, and a set of preferences which may be edited by clicking on the \"<a href=\"%user-prefs\">my account</a>\" link. Of course, a user must be logged into reach those pages. There, users will find a page for changing their preferred time zone, language, username, e-mail address, password, theme, signature, and <a href=\"%da-auth\">distributed authentication names</a>. Changes made here take effect immediately. Also, administrators may make profile and preferences changes in <a href=\"%admin-user\">account administration</a> on behalf of their users.</p>

      <h3>Distributed authentication<a id=\"da\"></a></h3>
      <p>One of the more tedious moments in visiting a new website is filling out the registration form. The reg form provides helpful information to the website owner, but not much value for the user. The value for the end user is usually the ability to post a messages or receive personalized news, etc. Distributed authentication (DA) gives the user what they want without having to fill out the reg form. Removing this obstacle yields more registered and active users for the website.</p>
      <p>DA enables a new user to input a username and password into the login box and immediately be recognized, even if that user never registered on your site. This works because Drupal knows how to communicate with external registration databases. For example, lets say that your new user 'Joe' is already a registered member of Delphi Forums. If your Drupal has the delphi module installed, then Drupal will inform Joe on the registration and login screens that he may login with his Delphi ID instead of registering with your Drupal instance. Joe likes that idea, and logs in with a username of joe@remote.delphiforums.com and his usual Delphi password. Drupal then communicates with remote.delphiforums.com (usually using <a href=\"%xml\">XML</a>, <a href=\"%http-post\">HTTP-POST</a>, or <a href=\"%soap\">SOAP</a>) behind the scenes and asks &quot;is this password for username=joe?&quot; If Delphi replies yes, then Drupal will create a new local account for joe and log joe into it. Joe may keep on logging into your Drupal instance in the same manner, and he will be logged into the same joe@remote.delphiforums.com account.</p>
      <p>One key element of DA is the 'authmap' table, which maps a user's authname (e.g. joe@remote.delphiforums.com) to his local UID (i.e. user identification number). This map is checked whenever a user successfully logs into an external authentication source. Once Drupal knows that the current user is definitely joe@remote.delphiforums.com (because Delphi says so), he looks up Joe's UID and logs Joe into that account.</p>
      <p>To disable distributed authentication, simply <a href=\"%dis-module\">disable</a> or remove all DA modules. For a virgin install, that means removing/disabling the jabber module and the drupal module.</p>
      <p>Drupal is setup so that it is very easy to add support for any external authentication source. You currently have the following authentication modules installed ...</p>", array('%user-role' => url('admin/access/roles'), '%user-permission' => url('admin/access/permissions'), '%jabber' => 'http://www.jabber.org/', '%delphi-forums' => 'http://www.delphiforums.com/', '%drupal' => 'http://www.drupal.org/', '%da-auth' => url('admin/help/user#da'), '%php-sess' => 'http://www.php.net/manual/en/ref.session.php', '%admin-user' => url('admin/user'), '%xml' => 'http://www.xmlrpc.org/', '%http-post' => 'http://www.w3.org/Protocols/', '%soap' => 'http://www.soapware.org/', '%dis-module' => url('admin/modules'),  '%user-prefs' => url('user/' . $user->uid)));

      foreach (module_list() as $module) {
        if (module_hook($module, 'auth')) {
          $output = strtr($output, array('%module-list' => '<h4>'. module_invoke($module, 'info', 'name') ."</h4>\n%module-list"));
          $output = strtr($output, array('%module-list' => module_invoke($module, 'help', 'user/help') . "\n%module-list"));
        }
      }

      return strtr($output, array('%module-list' => ''));
  }

}

/**
 * Menu callback; Prints user-specific help information.
 */
function user_help_page() {
  return user_help('user/help#user');
}

/**
 * Retrieve a list of all user setting/information categories and sort them by weight.
 */
function _user_categories() {
  $categories = array();

  foreach (module_list() as $module) {
    if ($data = module_invoke($module, 'user', 'categories', NULL, NULL, '')) {
      $categories = array_merge($data, $categories);
    }
  }

  usort($categories, '_user_sort');

  return $categories;
}

function _user_sort($a, $b) {
  return $a['weight'] < $b['weight'] ? -1 : ($a['weight'] > $b['weight'] ? 1 : ($a['title'] < $b['title'] ? -1 : 1));
}

/**
 * Retrieve a list of all form elements for the specified category.
 */
function _user_forms(&$edit, $account, $category, $hook = 'form') {
  $groups = array();
  foreach (module_list() as $module) {
    if ($data = module_invoke($module, 'user', $hook, $edit, $account, $category)) {
      $groups = array_merge($data, $groups);
    }
  }

  usort($groups, '_user_sort');

  $output = '';
  foreach ($groups as $group) {
    $output .= form_group($group['title'], $group['data']);
  }

  return $output;
}

/**
 * Retrieve a pipe delimited string of autocomplete suggestions for existing users
 */
function user_autocomplete($string) {
  $matches = array();
  $result = db_query_range('SELECT name FROM {users} WHERE LOWER(name) LIKE LOWER("%%%s%%")', $string, 0, 10);
  while ($user = db_fetch_object($result)) {
    $matches[$user->name] = check_plain($user->name);
  }
  print drupal_implode_autocomplete($matches);
  exit();
}