Localisation updates from http://translatewiki.net.
[mediawiki.git] / includes / User.php
blob5a525bf46f899e2fb98c65f6a3798540f6b1b67b
1 <?php
2 /**
3 * Implements the User class for the %MediaWiki software.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
20 * @file
23 /**
24 * Int Number of characters in user_token field.
25 * @ingroup Constants
27 define( 'USER_TOKEN_LENGTH', 32 );
29 /**
30 * Int Serialized record version.
31 * @ingroup Constants
33 define( 'MW_USER_VERSION', 8 );
35 /**
36 * String Some punctuation to prevent editing from broken text-mangling proxies.
37 * @ingroup Constants
39 define( 'EDIT_TOKEN_SUFFIX', '+\\' );
41 /**
42 * Thrown by User::setPassword() on error.
43 * @ingroup Exception
45 class PasswordError extends MWException {
46 // NOP
49 /**
50 * The User object encapsulates all of the user-specific settings (user_id,
51 * name, rights, password, email address, options, last login time). Client
52 * classes use the getXXX() functions to access these fields. These functions
53 * do all the work of determining whether the user is logged in,
54 * whether the requested option can be satisfied from cookies or
55 * whether a database query is needed. Most of the settings needed
56 * for rendering normal pages are set in the cookie to minimize use
57 * of the database.
59 class User {
60 /**
61 * Global constants made accessible as class constants so that autoloader
62 * magic can be used.
64 const USER_TOKEN_LENGTH = USER_TOKEN_LENGTH;
65 const MW_USER_VERSION = MW_USER_VERSION;
66 const EDIT_TOKEN_SUFFIX = EDIT_TOKEN_SUFFIX;
68 /**
69 * Maximum items in $mWatchedItems
71 const MAX_WATCHED_ITEMS_CACHE = 100;
73 /**
74 * Array of Strings List of member variables which are saved to the
75 * shared cache (memcached). Any operation which changes the
76 * corresponding database fields must call a cache-clearing function.
77 * @showinitializer
79 static $mCacheVars = array(
80 // user table
81 'mId',
82 'mName',
83 'mRealName',
84 'mPassword',
85 'mNewpassword',
86 'mNewpassTime',
87 'mEmail',
88 'mTouched',
89 'mToken',
90 'mEmailAuthenticated',
91 'mEmailToken',
92 'mEmailTokenExpires',
93 'mRegistration',
94 'mEditCount',
95 // user_groups table
96 'mGroups',
97 // user_properties table
98 'mOptionOverrides',
102 * Array of Strings Core rights.
103 * Each of these should have a corresponding message of the form
104 * "right-$right".
105 * @showinitializer
107 static $mCoreRights = array(
108 'apihighlimits',
109 'autoconfirmed',
110 'autopatrol',
111 'bigdelete',
112 'block',
113 'blockemail',
114 'bot',
115 'browsearchive',
116 'createaccount',
117 'createpage',
118 'createtalk',
119 'delete',
120 'deletedhistory',
121 'deletedtext',
122 'deletelogentry',
123 'deleterevision',
124 'edit',
125 'editinterface',
126 'editprotected',
127 'editusercssjs', #deprecated
128 'editusercss',
129 'edituserjs',
130 'hideuser',
131 'import',
132 'importupload',
133 'ipblock-exempt',
134 'markbotedits',
135 'mergehistory',
136 'minoredit',
137 'move',
138 'movefile',
139 'move-rootuserpages',
140 'move-subpages',
141 'nominornewtalk',
142 'noratelimit',
143 'override-export-depth',
144 'passwordreset',
145 'patrol',
146 'patrolmarks',
147 'protect',
148 'proxyunbannable',
149 'purge',
150 'read',
151 'reupload',
152 'reupload-own',
153 'reupload-shared',
154 'rollback',
155 'sendemail',
156 'siteadmin',
157 'suppressionlog',
158 'suppressredirect',
159 'suppressrevision',
160 'unblockself',
161 'undelete',
162 'unwatchedpages',
163 'upload',
164 'upload_by_url',
165 'userrights',
166 'userrights-interwiki',
167 'writeapi',
170 * String Cached results of getAllRights()
172 static $mAllRights = false;
174 /** @name Cache variables */
175 //@{
176 var $mId, $mName, $mRealName, $mPassword, $mNewpassword, $mNewpassTime,
177 $mEmail, $mTouched, $mToken, $mEmailAuthenticated,
178 $mEmailToken, $mEmailTokenExpires, $mRegistration, $mEditCount,
179 $mGroups, $mOptionOverrides;
180 //@}
183 * Bool Whether the cache variables have been loaded.
185 //@{
186 var $mOptionsLoaded;
189 * Array with already loaded items or true if all items have been loaded.
191 private $mLoadedItems = array();
192 //@}
195 * String Initialization data source if mLoadedItems!==true. May be one of:
196 * - 'defaults' anonymous user initialised from class defaults
197 * - 'name' initialise from mName
198 * - 'id' initialise from mId
199 * - 'session' log in from cookies or session if possible
201 * Use the User::newFrom*() family of functions to set this.
203 var $mFrom;
206 * Lazy-initialized variables, invalidated with clearInstanceCache
208 var $mNewtalk, $mDatePreference, $mBlockedby, $mHash, $mRights,
209 $mBlockreason, $mEffectiveGroups, $mImplicitGroups, $mFormerGroups, $mBlockedGlobally,
210 $mLocked, $mHideName, $mOptions;
213 * @var WebRequest
215 private $mRequest;
218 * @var Block
220 var $mBlock;
223 * @var bool
225 var $mAllowUsertalk;
228 * @var Block
230 private $mBlockedFromCreateAccount = false;
233 * @var Array
235 private $mWatchedItems = array();
237 static $idCacheByName = array();
240 * Lightweight constructor for an anonymous user.
241 * Use the User::newFrom* factory functions for other kinds of users.
243 * @see newFromName()
244 * @see newFromId()
245 * @see newFromConfirmationCode()
246 * @see newFromSession()
247 * @see newFromRow()
249 function __construct() {
250 $this->clearInstanceCache( 'defaults' );
254 * @return String
256 function __toString() {
257 return $this->getName();
261 * Load the user table data for this object from the source given by mFrom.
263 public function load() {
264 if ( $this->mLoadedItems === true ) {
265 return;
267 wfProfileIn( __METHOD__ );
269 # Set it now to avoid infinite recursion in accessors
270 $this->mLoadedItems = true;
272 switch ( $this->mFrom ) {
273 case 'defaults':
274 $this->loadDefaults();
275 break;
276 case 'name':
277 $this->mId = self::idFromName( $this->mName );
278 if ( !$this->mId ) {
279 # Nonexistent user placeholder object
280 $this->loadDefaults( $this->mName );
281 } else {
282 $this->loadFromId();
284 break;
285 case 'id':
286 $this->loadFromId();
287 break;
288 case 'session':
289 if ( !$this->loadFromSession() ) {
290 // Loading from session failed. Load defaults.
291 $this->loadDefaults();
293 wfRunHooks( 'UserLoadAfterLoadFromSession', array( $this ) );
294 break;
295 default:
296 wfProfileOut( __METHOD__ );
297 throw new MWException( "Unrecognised value for User->mFrom: \"{$this->mFrom}\"" );
299 wfProfileOut( __METHOD__ );
303 * Load user table data, given mId has already been set.
304 * @return Bool false if the ID does not exist, true otherwise
306 public function loadFromId() {
307 global $wgMemc;
308 if ( $this->mId == 0 ) {
309 $this->loadDefaults();
310 return false;
313 # Try cache
314 $key = wfMemcKey( 'user', 'id', $this->mId );
315 $data = $wgMemc->get( $key );
316 if ( !is_array( $data ) || $data['mVersion'] < MW_USER_VERSION ) {
317 # Object is expired, load from DB
318 $data = false;
321 if ( !$data ) {
322 wfDebug( "User: cache miss for user {$this->mId}\n" );
323 # Load from DB
324 if ( !$this->loadFromDatabase() ) {
325 # Can't load from ID, user is anonymous
326 return false;
328 $this->saveToCache();
329 } else {
330 wfDebug( "User: got user {$this->mId} from cache\n" );
331 # Restore from cache
332 foreach ( self::$mCacheVars as $name ) {
333 $this->$name = $data[$name];
337 $this->mLoadedItems = true;
339 return true;
343 * Save user data to the shared cache
345 public function saveToCache() {
346 $this->load();
347 $this->loadGroups();
348 $this->loadOptions();
349 if ( $this->isAnon() ) {
350 // Anonymous users are uncached
351 return;
353 $data = array();
354 foreach ( self::$mCacheVars as $name ) {
355 $data[$name] = $this->$name;
357 $data['mVersion'] = MW_USER_VERSION;
358 $key = wfMemcKey( 'user', 'id', $this->mId );
359 global $wgMemc;
360 $wgMemc->set( $key, $data );
363 /** @name newFrom*() static factory methods */
364 //@{
367 * Static factory method for creation from username.
369 * This is slightly less efficient than newFromId(), so use newFromId() if
370 * you have both an ID and a name handy.
372 * @param string $name Username, validated by Title::newFromText()
373 * @param string|Bool $validate Validate username. Takes the same parameters as
374 * User::getCanonicalName(), except that true is accepted as an alias
375 * for 'valid', for BC.
377 * @return User|bool User object, or false if the username is invalid
378 * (e.g. if it contains illegal characters or is an IP address). If the
379 * username is not present in the database, the result will be a user object
380 * with a name, zero user ID and default settings.
382 public static function newFromName( $name, $validate = 'valid' ) {
383 if ( $validate === true ) {
384 $validate = 'valid';
386 $name = self::getCanonicalName( $name, $validate );
387 if ( $name === false ) {
388 return false;
389 } else {
390 # Create unloaded user object
391 $u = new User;
392 $u->mName = $name;
393 $u->mFrom = 'name';
394 $u->setItemLoaded( 'name' );
395 return $u;
400 * Static factory method for creation from a given user ID.
402 * @param int $id Valid user ID
403 * @return User The corresponding User object
405 public static function newFromId( $id ) {
406 $u = new User;
407 $u->mId = $id;
408 $u->mFrom = 'id';
409 $u->setItemLoaded( 'id' );
410 return $u;
414 * Factory method to fetch whichever user has a given email confirmation code.
415 * This code is generated when an account is created or its e-mail address
416 * has changed.
418 * If the code is invalid or has expired, returns NULL.
420 * @param string $code Confirmation code
421 * @return User object, or null
423 public static function newFromConfirmationCode( $code ) {
424 $dbr = wfGetDB( DB_SLAVE );
425 $id = $dbr->selectField( 'user', 'user_id', array(
426 'user_email_token' => md5( $code ),
427 'user_email_token_expires > ' . $dbr->addQuotes( $dbr->timestamp() ),
428 ) );
429 if ( $id !== false ) {
430 return User::newFromId( $id );
431 } else {
432 return null;
437 * Create a new user object using data from session or cookies. If the
438 * login credentials are invalid, the result is an anonymous user.
440 * @param $request WebRequest object to use; $wgRequest will be used if omitted.
441 * @return User object
443 public static function newFromSession( WebRequest $request = null ) {
444 $user = new User;
445 $user->mFrom = 'session';
446 $user->mRequest = $request;
447 return $user;
451 * Create a new user object from a user row.
452 * The row should have the following fields from the user table in it:
453 * - either user_name or user_id to load further data if needed (or both)
454 * - user_real_name
455 * - all other fields (email, password, etc.)
456 * It is useless to provide the remaining fields if either user_id,
457 * user_name and user_real_name are not provided because the whole row
458 * will be loaded once more from the database when accessing them.
460 * @param array $row A row from the user table
461 * @param array $data Further data to load into the object (see User::loadFromRow for valid keys)
462 * @return User
464 public static function newFromRow( $row, $data = null ) {
465 $user = new User;
466 $user->loadFromRow( $row, $data );
467 return $user;
470 //@}
473 * Get the username corresponding to a given user ID
474 * @param int $id User ID
475 * @return String|bool The corresponding username
477 public static function whoIs( $id ) {
478 return UserCache::singleton()->getProp( $id, 'name' );
482 * Get the real name of a user given their user ID
484 * @param int $id User ID
485 * @return String|bool The corresponding user's real name
487 public static function whoIsReal( $id ) {
488 return UserCache::singleton()->getProp( $id, 'real_name' );
492 * Get database id given a user name
493 * @param string $name Username
494 * @return Int|Null The corresponding user's ID, or null if user is nonexistent
496 public static function idFromName( $name ) {
497 $nt = Title::makeTitleSafe( NS_USER, $name );
498 if ( is_null( $nt ) ) {
499 # Illegal name
500 return null;
503 if ( isset( self::$idCacheByName[$name] ) ) {
504 return self::$idCacheByName[$name];
507 $dbr = wfGetDB( DB_SLAVE );
508 $s = $dbr->selectRow( 'user', array( 'user_id' ), array( 'user_name' => $nt->getText() ), __METHOD__ );
510 if ( $s === false ) {
511 $result = null;
512 } else {
513 $result = $s->user_id;
516 self::$idCacheByName[$name] = $result;
518 if ( count( self::$idCacheByName ) > 1000 ) {
519 self::$idCacheByName = array();
522 return $result;
526 * Reset the cache used in idFromName(). For use in tests.
528 public static function resetIdByNameCache() {
529 self::$idCacheByName = array();
533 * Does the string match an anonymous IPv4 address?
535 * This function exists for username validation, in order to reject
536 * usernames which are similar in form to IP addresses. Strings such
537 * as 300.300.300.300 will return true because it looks like an IP
538 * address, despite not being strictly valid.
540 * We match "\d{1,3}\.\d{1,3}\.\d{1,3}\.xxx" as an anonymous IP
541 * address because the usemod software would "cloak" anonymous IP
542 * addresses like this, if we allowed accounts like this to be created
543 * new users could get the old edits of these anonymous users.
545 * @param string $name to match
546 * @return Bool
548 public static function isIP( $name ) {
549 return preg_match( '/^\d{1,3}\.\d{1,3}\.\d{1,3}\.(?:xxx|\d{1,3})$/', $name ) || IP::isIPv6( $name );
553 * Is the input a valid username?
555 * Checks if the input is a valid username, we don't want an empty string,
556 * an IP address, anything that contains slashes (would mess up subpages),
557 * is longer than the maximum allowed username size or doesn't begin with
558 * a capital letter.
560 * @param string $name to match
561 * @return Bool
563 public static function isValidUserName( $name ) {
564 global $wgContLang, $wgMaxNameChars;
566 if ( $name == ''
567 || User::isIP( $name )
568 || strpos( $name, '/' ) !== false
569 || strlen( $name ) > $wgMaxNameChars
570 || $name != $wgContLang->ucfirst( $name ) ) {
571 wfDebugLog( 'username', __METHOD__ .
572 ": '$name' invalid due to empty, IP, slash, length, or lowercase" );
573 return false;
576 // Ensure that the name can't be misresolved as a different title,
577 // such as with extra namespace keys at the start.
578 $parsed = Title::newFromText( $name );
579 if ( is_null( $parsed )
580 || $parsed->getNamespace()
581 || strcmp( $name, $parsed->getPrefixedText() ) ) {
582 wfDebugLog( 'username', __METHOD__ .
583 ": '$name' invalid due to ambiguous prefixes" );
584 return false;
587 // Check an additional blacklist of troublemaker characters.
588 // Should these be merged into the title char list?
589 $unicodeBlacklist = '/[' .
590 '\x{0080}-\x{009f}' . # iso-8859-1 control chars
591 '\x{00a0}' . # non-breaking space
592 '\x{2000}-\x{200f}' . # various whitespace
593 '\x{2028}-\x{202f}' . # breaks and control chars
594 '\x{3000}' . # ideographic space
595 '\x{e000}-\x{f8ff}' . # private use
596 ']/u';
597 if ( preg_match( $unicodeBlacklist, $name ) ) {
598 wfDebugLog( 'username', __METHOD__ .
599 ": '$name' invalid due to blacklisted characters" );
600 return false;
603 return true;
607 * Usernames which fail to pass this function will be blocked
608 * from user login and new account registrations, but may be used
609 * internally by batch processes.
611 * If an account already exists in this form, login will be blocked
612 * by a failure to pass this function.
614 * @param string $name to match
615 * @return Bool
617 public static function isUsableName( $name ) {
618 global $wgReservedUsernames;
619 // Must be a valid username, obviously ;)
620 if ( !self::isValidUserName( $name ) ) {
621 return false;
624 static $reservedUsernames = false;
625 if ( !$reservedUsernames ) {
626 $reservedUsernames = $wgReservedUsernames;
627 wfRunHooks( 'UserGetReservedNames', array( &$reservedUsernames ) );
630 // Certain names may be reserved for batch processes.
631 foreach ( $reservedUsernames as $reserved ) {
632 if ( substr( $reserved, 0, 4 ) == 'msg:' ) {
633 $reserved = wfMessage( substr( $reserved, 4 ) )->inContentLanguage()->text();
635 if ( $reserved == $name ) {
636 return false;
639 return true;
643 * Usernames which fail to pass this function will be blocked
644 * from new account registrations, but may be used internally
645 * either by batch processes or by user accounts which have
646 * already been created.
648 * Additional blacklisting may be added here rather than in
649 * isValidUserName() to avoid disrupting existing accounts.
651 * @param string $name to match
652 * @return Bool
654 public static function isCreatableName( $name ) {
655 global $wgInvalidUsernameCharacters;
657 // Ensure that the username isn't longer than 235 bytes, so that
658 // (at least for the builtin skins) user javascript and css files
659 // will work. (bug 23080)
660 if ( strlen( $name ) > 235 ) {
661 wfDebugLog( 'username', __METHOD__ .
662 ": '$name' invalid due to length" );
663 return false;
666 // Preg yells if you try to give it an empty string
667 if ( $wgInvalidUsernameCharacters !== '' ) {
668 if ( preg_match( '/[' . preg_quote( $wgInvalidUsernameCharacters, '/' ) . ']/', $name ) ) {
669 wfDebugLog( 'username', __METHOD__ .
670 ": '$name' invalid due to wgInvalidUsernameCharacters" );
671 return false;
675 return self::isUsableName( $name );
679 * Is the input a valid password for this user?
681 * @param string $password Desired password
682 * @return Bool
684 public function isValidPassword( $password ) {
685 //simple boolean wrapper for getPasswordValidity
686 return $this->getPasswordValidity( $password ) === true;
690 * Given unvalidated password input, return error message on failure.
692 * @param string $password Desired password
693 * @return mixed: true on success, string or array of error message on failure
695 public function getPasswordValidity( $password ) {
696 global $wgMinimalPasswordLength, $wgContLang;
698 static $blockedLogins = array(
699 'Useruser' => 'Passpass', 'Useruser1' => 'Passpass1', # r75589
700 'Apitestsysop' => 'testpass', 'Apitestuser' => 'testpass' # r75605
703 $result = false; //init $result to false for the internal checks
705 if ( !wfRunHooks( 'isValidPassword', array( $password, &$result, $this ) ) ) {
706 return $result;
709 if ( $result === false ) {
710 if ( strlen( $password ) < $wgMinimalPasswordLength ) {
711 return 'passwordtooshort';
712 } elseif ( $wgContLang->lc( $password ) == $wgContLang->lc( $this->mName ) ) {
713 return 'password-name-match';
714 } elseif ( isset( $blockedLogins[$this->getName()] ) && $password == $blockedLogins[$this->getName()] ) {
715 return 'password-login-forbidden';
716 } else {
717 //it seems weird returning true here, but this is because of the
718 //initialization of $result to false above. If the hook is never run or it
719 //doesn't modify $result, then we will likely get down into this if with
720 //a valid password.
721 return true;
723 } elseif ( $result === true ) {
724 return true;
725 } else {
726 return $result; //the isValidPassword hook set a string $result and returned true
731 * Does a string look like an e-mail address?
733 * This validates an email address using an HTML5 specification found at:
734 * http://www.whatwg.org/specs/web-apps/current-work/multipage/states-of-the-type-attribute.html#valid-e-mail-address
735 * Which as of 2011-01-24 says:
737 * A valid e-mail address is a string that matches the ABNF production
738 * 1*( atext / "." ) "@" ldh-str *( "." ldh-str ) where atext is defined
739 * in RFC 5322 section 3.2.3, and ldh-str is defined in RFC 1034 section
740 * 3.5.
742 * This function is an implementation of the specification as requested in
743 * bug 22449.
745 * Client-side forms will use the same standard validation rules via JS or
746 * HTML 5 validation; additional restrictions can be enforced server-side
747 * by extensions via the 'isValidEmailAddr' hook.
749 * Note that this validation doesn't 100% match RFC 2822, but is believed
750 * to be liberal enough for wide use. Some invalid addresses will still
751 * pass validation here.
753 * @param string $addr E-mail address
754 * @return Bool
755 * @deprecated since 1.18 call Sanitizer::isValidEmail() directly
757 public static function isValidEmailAddr( $addr ) {
758 wfDeprecated( __METHOD__, '1.18' );
759 return Sanitizer::validateEmail( $addr );
763 * Given unvalidated user input, return a canonical username, or false if
764 * the username is invalid.
765 * @param string $name User input
766 * @param string|Bool $validate type of validation to use:
767 * - false No validation
768 * - 'valid' Valid for batch processes
769 * - 'usable' Valid for batch processes and login
770 * - 'creatable' Valid for batch processes, login and account creation
772 * @throws MWException
773 * @return bool|string
775 public static function getCanonicalName( $name, $validate = 'valid' ) {
776 # Force usernames to capital
777 global $wgContLang;
778 $name = $wgContLang->ucfirst( $name );
780 # Reject names containing '#'; these will be cleaned up
781 # with title normalisation, but then it's too late to
782 # check elsewhere
783 if ( strpos( $name, '#' ) !== false ) {
784 return false;
787 # Clean up name according to title rules
788 $t = ( $validate === 'valid' ) ?
789 Title::newFromText( $name ) : Title::makeTitle( NS_USER, $name );
790 # Check for invalid titles
791 if ( is_null( $t ) ) {
792 return false;
795 # Reject various classes of invalid names
796 global $wgAuth;
797 $name = $wgAuth->getCanonicalName( $t->getText() );
799 switch ( $validate ) {
800 case false:
801 break;
802 case 'valid':
803 if ( !User::isValidUserName( $name ) ) {
804 $name = false;
806 break;
807 case 'usable':
808 if ( !User::isUsableName( $name ) ) {
809 $name = false;
811 break;
812 case 'creatable':
813 if ( !User::isCreatableName( $name ) ) {
814 $name = false;
816 break;
817 default:
818 throw new MWException( 'Invalid parameter value for $validate in ' . __METHOD__ );
820 return $name;
824 * Count the number of edits of a user
826 * @param int $uid User ID to check
827 * @return Int the user's edit count
829 * @deprecated since 1.21 in favour of User::getEditCount
831 public static function edits( $uid ) {
832 wfDeprecated( __METHOD__, '1.21' );
833 $user = self::newFromId( $uid );
834 return $user->getEditCount();
838 * Return a random password.
840 * @return String new random password
842 public static function randomPassword() {
843 global $wgMinimalPasswordLength;
844 // Decide the final password length based on our min password length, stopping at a minimum of 10 chars
845 $length = max( 10, $wgMinimalPasswordLength );
846 // Multiply by 1.25 to get the number of hex characters we need
847 $length = $length * 1.25;
848 // Generate random hex chars
849 $hex = MWCryptRand::generateHex( $length );
850 // Convert from base 16 to base 32 to get a proper password like string
851 return wfBaseConvert( $hex, 16, 32 );
855 * Set cached properties to default.
857 * @note This no longer clears uncached lazy-initialised properties;
858 * the constructor does that instead.
860 * @param $name string|bool
862 public function loadDefaults( $name = false ) {
863 wfProfileIn( __METHOD__ );
865 $this->mId = 0;
866 $this->mName = $name;
867 $this->mRealName = '';
868 $this->mPassword = $this->mNewpassword = '';
869 $this->mNewpassTime = null;
870 $this->mEmail = '';
871 $this->mOptionOverrides = null;
872 $this->mOptionsLoaded = false;
874 $loggedOut = $this->getRequest()->getCookie( 'LoggedOut' );
875 if ( $loggedOut !== null ) {
876 $this->mTouched = wfTimestamp( TS_MW, $loggedOut );
877 } else {
878 $this->mTouched = '1'; # Allow any pages to be cached
881 $this->mToken = null; // Don't run cryptographic functions till we need a token
882 $this->mEmailAuthenticated = null;
883 $this->mEmailToken = '';
884 $this->mEmailTokenExpires = null;
885 $this->mRegistration = wfTimestamp( TS_MW );
886 $this->mGroups = array();
888 wfRunHooks( 'UserLoadDefaults', array( $this, $name ) );
890 wfProfileOut( __METHOD__ );
894 * Return whether an item has been loaded.
896 * @param string $item item to check. Current possibilities:
897 * - id
898 * - name
899 * - realname
900 * @param string $all 'all' to check if the whole object has been loaded
901 * or any other string to check if only the item is available (e.g.
902 * for optimisation)
903 * @return Boolean
905 public function isItemLoaded( $item, $all = 'all' ) {
906 return ( $this->mLoadedItems === true && $all === 'all' ) ||
907 ( isset( $this->mLoadedItems[$item] ) && $this->mLoadedItems[$item] === true );
911 * Set that an item has been loaded
913 * @param $item String
915 private function setItemLoaded( $item ) {
916 if ( is_array( $this->mLoadedItems ) ) {
917 $this->mLoadedItems[$item] = true;
922 * Load user data from the session or login cookie.
923 * @return Bool True if the user is logged in, false otherwise.
925 private function loadFromSession() {
926 $result = null;
927 wfRunHooks( 'UserLoadFromSession', array( $this, &$result ) );
928 if ( $result !== null ) {
929 return $result;
932 $request = $this->getRequest();
934 $cookieId = $request->getCookie( 'UserID' );
935 $sessId = $request->getSessionData( 'wsUserID' );
937 if ( $cookieId !== null ) {
938 $sId = intval( $cookieId );
939 if ( $sessId !== null && $cookieId != $sessId ) {
940 wfDebugLog( 'loginSessions', "Session user ID ($sessId) and
941 cookie user ID ($sId) don't match!" );
942 return false;
944 $request->setSessionData( 'wsUserID', $sId );
945 } elseif ( $sessId !== null && $sessId != 0 ) {
946 $sId = $sessId;
947 } else {
948 return false;
951 if ( $request->getSessionData( 'wsUserName' ) !== null ) {
952 $sName = $request->getSessionData( 'wsUserName' );
953 } elseif ( $request->getCookie( 'UserName' ) !== null ) {
954 $sName = $request->getCookie( 'UserName' );
955 $request->setSessionData( 'wsUserName', $sName );
956 } else {
957 return false;
960 $proposedUser = User::newFromId( $sId );
961 if ( !$proposedUser->isLoggedIn() ) {
962 # Not a valid ID
963 return false;
966 global $wgBlockDisablesLogin;
967 if ( $wgBlockDisablesLogin && $proposedUser->isBlocked() ) {
968 # User blocked and we've disabled blocked user logins
969 return false;
972 if ( $request->getSessionData( 'wsToken' ) ) {
973 $passwordCorrect = ( $proposedUser->getToken( false ) === $request->getSessionData( 'wsToken' ) );
974 $from = 'session';
975 } elseif ( $request->getCookie( 'Token' ) ) {
976 # Get the token from DB/cache and clean it up to remove garbage padding.
977 # This deals with historical problems with bugs and the default column value.
978 $token = rtrim( $proposedUser->getToken( false ) ); // correct token
979 $passwordCorrect = ( strlen( $token ) && $token === $request->getCookie( 'Token' ) );
980 $from = 'cookie';
981 } else {
982 # No session or persistent login cookie
983 return false;
986 if ( ( $sName === $proposedUser->getName() ) && $passwordCorrect ) {
987 $this->loadFromUserObject( $proposedUser );
988 $request->setSessionData( 'wsToken', $this->mToken );
989 wfDebug( "User: logged in from $from\n" );
990 return true;
991 } else {
992 # Invalid credentials
993 wfDebug( "User: can't log in from $from, invalid credentials\n" );
994 return false;
999 * Load user and user_group data from the database.
1000 * $this->mId must be set, this is how the user is identified.
1002 * @return Bool True if the user exists, false if the user is anonymous
1004 public function loadFromDatabase() {
1005 # Paranoia
1006 $this->mId = intval( $this->mId );
1008 /** Anonymous user */
1009 if ( !$this->mId ) {
1010 $this->loadDefaults();
1011 return false;
1014 $dbr = wfGetDB( DB_MASTER );
1015 $s = $dbr->selectRow( 'user', self::selectFields(), array( 'user_id' => $this->mId ), __METHOD__ );
1017 wfRunHooks( 'UserLoadFromDatabase', array( $this, &$s ) );
1019 if ( $s !== false ) {
1020 # Initialise user table data
1021 $this->loadFromRow( $s );
1022 $this->mGroups = null; // deferred
1023 $this->getEditCount(); // revalidation for nulls
1024 return true;
1025 } else {
1026 # Invalid user_id
1027 $this->mId = 0;
1028 $this->loadDefaults();
1029 return false;
1034 * Initialize this object from a row from the user table.
1036 * @param array $row Row from the user table to load.
1037 * @param array $data Further user data to load into the object
1039 * user_groups Array with groups out of the user_groups table
1040 * user_properties Array with properties out of the user_properties table
1042 public function loadFromRow( $row, $data = null ) {
1043 $all = true;
1045 $this->mGroups = null; // deferred
1047 if ( isset( $row->user_name ) ) {
1048 $this->mName = $row->user_name;
1049 $this->mFrom = 'name';
1050 $this->setItemLoaded( 'name' );
1051 } else {
1052 $all = false;
1055 if ( isset( $row->user_real_name ) ) {
1056 $this->mRealName = $row->user_real_name;
1057 $this->setItemLoaded( 'realname' );
1058 } else {
1059 $all = false;
1062 if ( isset( $row->user_id ) ) {
1063 $this->mId = intval( $row->user_id );
1064 $this->mFrom = 'id';
1065 $this->setItemLoaded( 'id' );
1066 } else {
1067 $all = false;
1070 if ( isset( $row->user_editcount ) ) {
1071 $this->mEditCount = $row->user_editcount;
1072 } else {
1073 $all = false;
1076 if ( isset( $row->user_password ) ) {
1077 $this->mPassword = $row->user_password;
1078 $this->mNewpassword = $row->user_newpassword;
1079 $this->mNewpassTime = wfTimestampOrNull( TS_MW, $row->user_newpass_time );
1080 $this->mEmail = $row->user_email;
1081 if ( isset( $row->user_options ) ) {
1082 $this->decodeOptions( $row->user_options );
1084 $this->mTouched = wfTimestamp( TS_MW, $row->user_touched );
1085 $this->mToken = $row->user_token;
1086 if ( $this->mToken == '' ) {
1087 $this->mToken = null;
1089 $this->mEmailAuthenticated = wfTimestampOrNull( TS_MW, $row->user_email_authenticated );
1090 $this->mEmailToken = $row->user_email_token;
1091 $this->mEmailTokenExpires = wfTimestampOrNull( TS_MW, $row->user_email_token_expires );
1092 $this->mRegistration = wfTimestampOrNull( TS_MW, $row->user_registration );
1093 } else {
1094 $all = false;
1097 if ( $all ) {
1098 $this->mLoadedItems = true;
1101 if ( is_array( $data ) ) {
1102 if ( isset( $data['user_groups'] ) && is_array( $data['user_groups'] ) ) {
1103 $this->mGroups = $data['user_groups'];
1105 if ( isset( $data['user_properties'] ) && is_array( $data['user_properties'] ) ) {
1106 $this->loadOptions( $data['user_properties'] );
1112 * Load the data for this user object from another user object.
1114 * @param $user User
1116 protected function loadFromUserObject( $user ) {
1117 $user->load();
1118 $user->loadGroups();
1119 $user->loadOptions();
1120 foreach ( self::$mCacheVars as $var ) {
1121 $this->$var = $user->$var;
1126 * Load the groups from the database if they aren't already loaded.
1128 private function loadGroups() {
1129 if ( is_null( $this->mGroups ) ) {
1130 $dbr = wfGetDB( DB_MASTER );
1131 $res = $dbr->select( 'user_groups',
1132 array( 'ug_group' ),
1133 array( 'ug_user' => $this->mId ),
1134 __METHOD__ );
1135 $this->mGroups = array();
1136 foreach ( $res as $row ) {
1137 $this->mGroups[] = $row->ug_group;
1143 * Add the user to the group if he/she meets given criteria.
1145 * Contrary to autopromotion by \ref $wgAutopromote, the group will be
1146 * possible to remove manually via Special:UserRights. In such case it
1147 * will not be re-added automatically. The user will also not lose the
1148 * group if they no longer meet the criteria.
1150 * @param string $event key in $wgAutopromoteOnce (each one has groups/criteria)
1152 * @return array Array of groups the user has been promoted to.
1154 * @see $wgAutopromoteOnce
1156 public function addAutopromoteOnceGroups( $event ) {
1157 global $wgAutopromoteOnceLogInRC;
1159 $toPromote = array();
1160 if ( $this->getId() ) {
1161 $toPromote = Autopromote::getAutopromoteOnceGroups( $this, $event );
1162 if ( count( $toPromote ) ) {
1163 $oldGroups = $this->getGroups(); // previous groups
1164 foreach ( $toPromote as $group ) {
1165 $this->addGroup( $group );
1167 $newGroups = array_merge( $oldGroups, $toPromote ); // all groups
1169 $logEntry = new ManualLogEntry( 'rights', 'autopromote' );
1170 $logEntry->setPerformer( $this );
1171 $logEntry->setTarget( $this->getUserPage() );
1172 $logEntry->setParameters( array(
1173 '4::oldgroups' => $oldGroups,
1174 '5::newgroups' => $newGroups,
1175 ) );
1176 $logid = $logEntry->insert();
1177 if ( $wgAutopromoteOnceLogInRC ) {
1178 $logEntry->publish( $logid );
1182 return $toPromote;
1186 * Clear various cached data stored in this object. The cache of the user table
1187 * data (i.e. self::$mCacheVars) is not cleared unless $reloadFrom is given.
1189 * @param bool|String $reloadFrom Reload user and user_groups table data from a
1190 * given source. May be "name", "id", "defaults", "session", or false for
1191 * no reload.
1193 public function clearInstanceCache( $reloadFrom = false ) {
1194 $this->mNewtalk = -1;
1195 $this->mDatePreference = null;
1196 $this->mBlockedby = -1; # Unset
1197 $this->mHash = false;
1198 $this->mRights = null;
1199 $this->mEffectiveGroups = null;
1200 $this->mImplicitGroups = null;
1201 $this->mGroups = null;
1202 $this->mOptions = null;
1203 $this->mOptionsLoaded = false;
1204 $this->mEditCount = null;
1206 if ( $reloadFrom ) {
1207 $this->mLoadedItems = array();
1208 $this->mFrom = $reloadFrom;
1213 * Combine the language default options with any site-specific options
1214 * and add the default language variants.
1216 * @return Array of String options
1218 public static function getDefaultOptions() {
1219 global $wgNamespacesToBeSearchedDefault, $wgDefaultUserOptions, $wgContLang, $wgDefaultSkin;
1221 static $defOpt = null;
1222 if ( !defined( 'MW_PHPUNIT_TEST' ) && $defOpt !== null ) {
1223 // Disabling this for the unit tests, as they rely on being able to change $wgContLang
1224 // mid-request and see that change reflected in the return value of this function.
1225 // Which is insane and would never happen during normal MW operation
1226 return $defOpt;
1229 $defOpt = $wgDefaultUserOptions;
1230 # default language setting
1231 $defOpt['variant'] = $wgContLang->getCode();
1232 $defOpt['language'] = $wgContLang->getCode();
1233 foreach ( SearchEngine::searchableNamespaces() as $nsnum => $nsname ) {
1234 $defOpt['searchNs' . $nsnum] = !empty( $wgNamespacesToBeSearchedDefault[$nsnum] );
1236 $defOpt['skin'] = $wgDefaultSkin;
1238 wfRunHooks( 'UserGetDefaultOptions', array( &$defOpt ) );
1240 return $defOpt;
1244 * Get a given default option value.
1246 * @param string $opt Name of option to retrieve
1247 * @return String Default option value
1249 public static function getDefaultOption( $opt ) {
1250 $defOpts = self::getDefaultOptions();
1251 if ( isset( $defOpts[$opt] ) ) {
1252 return $defOpts[$opt];
1253 } else {
1254 return null;
1259 * Get blocking information
1260 * @param bool $bFromSlave Whether to check the slave database first. To
1261 * improve performance, non-critical checks are done
1262 * against slaves. Check when actually saving should be
1263 * done against master.
1265 private function getBlockedStatus( $bFromSlave = true ) {
1266 global $wgProxyWhitelist, $wgUser, $wgApplyIpBlocksToXff;
1268 if ( -1 != $this->mBlockedby ) {
1269 return;
1272 wfProfileIn( __METHOD__ );
1273 wfDebug( __METHOD__ . ": checking...\n" );
1275 // Initialize data...
1276 // Otherwise something ends up stomping on $this->mBlockedby when
1277 // things get lazy-loaded later, causing false positive block hits
1278 // due to -1 !== 0. Probably session-related... Nothing should be
1279 // overwriting mBlockedby, surely?
1280 $this->load();
1282 # We only need to worry about passing the IP address to the Block generator if the
1283 # user is not immune to autoblocks/hardblocks, and they are the current user so we
1284 # know which IP address they're actually coming from
1285 if ( !$this->isAllowed( 'ipblock-exempt' ) && $this->getID() == $wgUser->getID() ) {
1286 $ip = $this->getRequest()->getIP();
1287 } else {
1288 $ip = null;
1291 # User/IP blocking
1292 $block = Block::newFromTarget( $this, $ip, !$bFromSlave );
1294 # Proxy blocking
1295 if ( !$block instanceof Block && $ip !== null && !$this->isAllowed( 'proxyunbannable' )
1296 && !in_array( $ip, $wgProxyWhitelist ) )
1298 # Local list
1299 if ( self::isLocallyBlockedProxy( $ip ) ) {
1300 $block = new Block;
1301 $block->setBlocker( wfMessage( 'proxyblocker' )->text() );
1302 $block->mReason = wfMessage( 'proxyblockreason' )->text();
1303 $block->setTarget( $ip );
1304 } elseif ( $this->isAnon() && $this->isDnsBlacklisted( $ip ) ) {
1305 $block = new Block;
1306 $block->setBlocker( wfMessage( 'sorbs' )->text() );
1307 $block->mReason = wfMessage( 'sorbsreason' )->text();
1308 $block->setTarget( $ip );
1312 # (bug 23343) Apply IP blocks to the contents of XFF headers, if enabled
1313 if ( !$block instanceof Block
1314 && $wgApplyIpBlocksToXff
1315 && $ip !== null
1316 && !$this->isAllowed( 'proxyunbannable' )
1317 && !in_array( $ip, $wgProxyWhitelist )
1319 $xff = $this->getRequest()->getHeader( 'X-Forwarded-For' );
1320 $xff = array_map( 'trim', explode( ',', $xff ) );
1321 $xff = array_diff( $xff, array( $ip ) );
1322 $xffblocks = Block::getBlocksForIPList( $xff, $this->isAnon(), !$bFromSlave );
1323 $block = Block::chooseBlock( $xffblocks, $xff );
1324 if ( $block instanceof Block ) {
1325 # Mangle the reason to alert the user that the block
1326 # originated from matching the X-Forwarded-For header.
1327 $block->mReason = wfMessage( 'xffblockreason', $block->mReason )->text();
1331 if ( $block instanceof Block ) {
1332 wfDebug( __METHOD__ . ": Found block.\n" );
1333 $this->mBlock = $block;
1334 $this->mBlockedby = $block->getByName();
1335 $this->mBlockreason = $block->mReason;
1336 $this->mHideName = $block->mHideName;
1337 $this->mAllowUsertalk = !$block->prevents( 'editownusertalk' );
1338 } else {
1339 $this->mBlockedby = '';
1340 $this->mHideName = 0;
1341 $this->mAllowUsertalk = false;
1344 // Extensions
1345 wfRunHooks( 'GetBlockedStatus', array( &$this ) );
1347 wfProfileOut( __METHOD__ );
1351 * Whether the given IP is in a DNS blacklist.
1353 * @param string $ip IP to check
1354 * @param bool $checkWhitelist whether to check the whitelist first
1355 * @return Bool True if blacklisted.
1357 public function isDnsBlacklisted( $ip, $checkWhitelist = false ) {
1358 global $wgEnableSorbs, $wgEnableDnsBlacklist,
1359 $wgSorbsUrl, $wgDnsBlacklistUrls, $wgProxyWhitelist;
1361 if ( !$wgEnableDnsBlacklist && !$wgEnableSorbs ) {
1362 return false;
1365 if ( $checkWhitelist && in_array( $ip, $wgProxyWhitelist ) ) {
1366 return false;
1369 $urls = array_merge( $wgDnsBlacklistUrls, (array)$wgSorbsUrl );
1370 return $this->inDnsBlacklist( $ip, $urls );
1374 * Whether the given IP is in a given DNS blacklist.
1376 * @param string $ip IP to check
1377 * @param string|array $bases of Strings: URL of the DNS blacklist
1378 * @return Bool True if blacklisted.
1380 public function inDnsBlacklist( $ip, $bases ) {
1381 wfProfileIn( __METHOD__ );
1383 $found = false;
1384 // @todo FIXME: IPv6 ??? (http://bugs.php.net/bug.php?id=33170)
1385 if ( IP::isIPv4( $ip ) ) {
1386 # Reverse IP, bug 21255
1387 $ipReversed = implode( '.', array_reverse( explode( '.', $ip ) ) );
1389 foreach ( (array)$bases as $base ) {
1390 # Make hostname
1391 # If we have an access key, use that too (ProjectHoneypot, etc.)
1392 if ( is_array( $base ) ) {
1393 if ( count( $base ) >= 2 ) {
1394 # Access key is 1, base URL is 0
1395 $host = "{$base[1]}.$ipReversed.{$base[0]}";
1396 } else {
1397 $host = "$ipReversed.{$base[0]}";
1399 } else {
1400 $host = "$ipReversed.$base";
1403 # Send query
1404 $ipList = gethostbynamel( $host );
1406 if ( $ipList ) {
1407 wfDebugLog( 'dnsblacklist', "Hostname $host is {$ipList[0]}, it's a proxy says $base!\n" );
1408 $found = true;
1409 break;
1410 } else {
1411 wfDebugLog( 'dnsblacklist', "Requested $host, not found in $base.\n" );
1416 wfProfileOut( __METHOD__ );
1417 return $found;
1421 * Check if an IP address is in the local proxy list
1423 * @param $ip string
1425 * @return bool
1427 public static function isLocallyBlockedProxy( $ip ) {
1428 global $wgProxyList;
1430 if ( !$wgProxyList ) {
1431 return false;
1433 wfProfileIn( __METHOD__ );
1435 if ( !is_array( $wgProxyList ) ) {
1436 # Load from the specified file
1437 $wgProxyList = array_map( 'trim', file( $wgProxyList ) );
1440 if ( !is_array( $wgProxyList ) ) {
1441 $ret = false;
1442 } elseif ( array_search( $ip, $wgProxyList ) !== false ) {
1443 $ret = true;
1444 } elseif ( array_key_exists( $ip, $wgProxyList ) ) {
1445 # Old-style flipped proxy list
1446 $ret = true;
1447 } else {
1448 $ret = false;
1450 wfProfileOut( __METHOD__ );
1451 return $ret;
1455 * Is this user subject to rate limiting?
1457 * @return Bool True if rate limited
1459 public function isPingLimitable() {
1460 global $wgRateLimitsExcludedIPs;
1461 if ( in_array( $this->getRequest()->getIP(), $wgRateLimitsExcludedIPs ) ) {
1462 // No other good way currently to disable rate limits
1463 // for specific IPs. :P
1464 // But this is a crappy hack and should die.
1465 return false;
1467 return !$this->isAllowed( 'noratelimit' );
1471 * Primitive rate limits: enforce maximum actions per time period
1472 * to put a brake on flooding.
1474 * @note When using a shared cache like memcached, IP-address
1475 * last-hit counters will be shared across wikis.
1477 * @param string $action Action to enforce; 'edit' if unspecified
1478 * @return Bool True if a rate limiter was tripped
1480 public function pingLimiter( $action = 'edit' ) {
1481 # Call the 'PingLimiter' hook
1482 $result = false;
1483 if ( !wfRunHooks( 'PingLimiter', array( &$this, $action, &$result ) ) ) {
1484 return $result;
1487 global $wgRateLimits;
1488 if ( !isset( $wgRateLimits[$action] ) ) {
1489 return false;
1492 # Some groups shouldn't trigger the ping limiter, ever
1493 if ( !$this->isPingLimitable() ) {
1494 return false;
1497 global $wgMemc, $wgRateLimitLog;
1498 wfProfileIn( __METHOD__ );
1500 $limits = $wgRateLimits[$action];
1501 $keys = array();
1502 $id = $this->getId();
1503 $ip = $this->getRequest()->getIP();
1504 $userLimit = false;
1506 if ( isset( $limits['anon'] ) && $id == 0 ) {
1507 $keys[wfMemcKey( 'limiter', $action, 'anon' )] = $limits['anon'];
1510 if ( isset( $limits['user'] ) && $id != 0 ) {
1511 $userLimit = $limits['user'];
1513 if ( $this->isNewbie() ) {
1514 if ( isset( $limits['newbie'] ) && $id != 0 ) {
1515 $keys[wfMemcKey( 'limiter', $action, 'user', $id )] = $limits['newbie'];
1517 if ( isset( $limits['ip'] ) ) {
1518 $keys["mediawiki:limiter:$action:ip:$ip"] = $limits['ip'];
1520 $matches = array();
1521 if ( isset( $limits['subnet'] ) && preg_match( '/^(\d+\.\d+\.\d+)\.\d+$/', $ip, $matches ) ) {
1522 $subnet = $matches[1];
1523 $keys["mediawiki:limiter:$action:subnet:$subnet"] = $limits['subnet'];
1526 // Check for group-specific permissions
1527 // If more than one group applies, use the group with the highest limit
1528 foreach ( $this->getGroups() as $group ) {
1529 if ( isset( $limits[$group] ) ) {
1530 if ( $userLimit === false || $limits[$group] > $userLimit ) {
1531 $userLimit = $limits[$group];
1535 // Set the user limit key
1536 if ( $userLimit !== false ) {
1537 list( $max, $period ) = $userLimit;
1538 wfDebug( __METHOD__ . ": effective user limit: $max in {$period}s\n" );
1539 $keys[wfMemcKey( 'limiter', $action, 'user', $id )] = $userLimit;
1542 $triggered = false;
1543 foreach ( $keys as $key => $limit ) {
1544 list( $max, $period ) = $limit;
1545 $summary = "(limit $max in {$period}s)";
1546 $count = $wgMemc->get( $key );
1547 // Already pinged?
1548 if ( $count ) {
1549 if ( $count >= $max ) {
1550 wfDebug( __METHOD__ . ": tripped! $key at $count $summary\n" );
1551 if ( $wgRateLimitLog ) {
1552 wfSuppressWarnings();
1553 file_put_contents( $wgRateLimitLog, wfTimestamp( TS_MW ) . ' ' . wfWikiID() . ': ' . $this->getName() . " tripped $key at $count $summary\n", FILE_APPEND );
1554 wfRestoreWarnings();
1556 $triggered = true;
1557 } else {
1558 wfDebug( __METHOD__ . ": ok. $key at $count $summary\n" );
1560 } else {
1561 wfDebug( __METHOD__ . ": adding record for $key $summary\n" );
1562 $wgMemc->add( $key, 0, intval( $period ) ); // first ping
1564 $wgMemc->incr( $key );
1567 wfProfileOut( __METHOD__ );
1568 return $triggered;
1572 * Check if user is blocked
1574 * @param bool $bFromSlave Whether to check the slave database instead of the master
1575 * @return Bool True if blocked, false otherwise
1577 public function isBlocked( $bFromSlave = true ) { // hacked from false due to horrible probs on site
1578 return $this->getBlock( $bFromSlave ) instanceof Block && $this->getBlock()->prevents( 'edit' );
1582 * Get the block affecting the user, or null if the user is not blocked
1584 * @param bool $bFromSlave Whether to check the slave database instead of the master
1585 * @return Block|null
1587 public function getBlock( $bFromSlave = true ) {
1588 $this->getBlockedStatus( $bFromSlave );
1589 return $this->mBlock instanceof Block ? $this->mBlock : null;
1593 * Check if user is blocked from editing a particular article
1595 * @param $title Title to check
1596 * @param bool $bFromSlave whether to check the slave database instead of the master
1597 * @return Bool
1599 function isBlockedFrom( $title, $bFromSlave = false ) {
1600 global $wgBlockAllowsUTEdit;
1601 wfProfileIn( __METHOD__ );
1603 $blocked = $this->isBlocked( $bFromSlave );
1604 $allowUsertalk = ( $wgBlockAllowsUTEdit ? $this->mAllowUsertalk : false );
1605 # If a user's name is suppressed, they cannot make edits anywhere
1606 if ( !$this->mHideName && $allowUsertalk && $title->getText() === $this->getName() &&
1607 $title->getNamespace() == NS_USER_TALK ) {
1608 $blocked = false;
1609 wfDebug( __METHOD__ . ": self-talk page, ignoring any blocks\n" );
1612 wfRunHooks( 'UserIsBlockedFrom', array( $this, $title, &$blocked, &$allowUsertalk ) );
1614 wfProfileOut( __METHOD__ );
1615 return $blocked;
1619 * If user is blocked, return the name of the user who placed the block
1620 * @return String name of blocker
1622 public function blockedBy() {
1623 $this->getBlockedStatus();
1624 return $this->mBlockedby;
1628 * If user is blocked, return the specified reason for the block
1629 * @return String Blocking reason
1631 public function blockedFor() {
1632 $this->getBlockedStatus();
1633 return $this->mBlockreason;
1637 * If user is blocked, return the ID for the block
1638 * @return Int Block ID
1640 public function getBlockId() {
1641 $this->getBlockedStatus();
1642 return ( $this->mBlock ? $this->mBlock->getId() : false );
1646 * Check if user is blocked on all wikis.
1647 * Do not use for actual edit permission checks!
1648 * This is intended for quick UI checks.
1650 * @param string $ip IP address, uses current client if none given
1651 * @return Bool True if blocked, false otherwise
1653 public function isBlockedGlobally( $ip = '' ) {
1654 if ( $this->mBlockedGlobally !== null ) {
1655 return $this->mBlockedGlobally;
1657 // User is already an IP?
1658 if ( IP::isIPAddress( $this->getName() ) ) {
1659 $ip = $this->getName();
1660 } elseif ( !$ip ) {
1661 $ip = $this->getRequest()->getIP();
1663 $blocked = false;
1664 wfRunHooks( 'UserIsBlockedGlobally', array( &$this, $ip, &$blocked ) );
1665 $this->mBlockedGlobally = (bool)$blocked;
1666 return $this->mBlockedGlobally;
1670 * Check if user account is locked
1672 * @return Bool True if locked, false otherwise
1674 public function isLocked() {
1675 if ( $this->mLocked !== null ) {
1676 return $this->mLocked;
1678 global $wgAuth;
1679 $authUser = $wgAuth->getUserInstance( $this );
1680 $this->mLocked = (bool)$authUser->isLocked();
1681 return $this->mLocked;
1685 * Check if user account is hidden
1687 * @return Bool True if hidden, false otherwise
1689 public function isHidden() {
1690 if ( $this->mHideName !== null ) {
1691 return $this->mHideName;
1693 $this->getBlockedStatus();
1694 if ( !$this->mHideName ) {
1695 global $wgAuth;
1696 $authUser = $wgAuth->getUserInstance( $this );
1697 $this->mHideName = (bool)$authUser->isHidden();
1699 return $this->mHideName;
1703 * Get the user's ID.
1704 * @return Int The user's ID; 0 if the user is anonymous or nonexistent
1706 public function getId() {
1707 if ( $this->mId === null && $this->mName !== null && User::isIP( $this->mName ) ) {
1708 // Special case, we know the user is anonymous
1709 return 0;
1710 } elseif ( !$this->isItemLoaded( 'id' ) ) {
1711 // Don't load if this was initialized from an ID
1712 $this->load();
1714 return $this->mId;
1718 * Set the user and reload all fields according to a given ID
1719 * @param int $v User ID to reload
1721 public function setId( $v ) {
1722 $this->mId = $v;
1723 $this->clearInstanceCache( 'id' );
1727 * Get the user name, or the IP of an anonymous user
1728 * @return String User's name or IP address
1730 public function getName() {
1731 if ( $this->isItemLoaded( 'name', 'only' ) ) {
1732 # Special case optimisation
1733 return $this->mName;
1734 } else {
1735 $this->load();
1736 if ( $this->mName === false ) {
1737 # Clean up IPs
1738 $this->mName = IP::sanitizeIP( $this->getRequest()->getIP() );
1740 return $this->mName;
1745 * Set the user name.
1747 * This does not reload fields from the database according to the given
1748 * name. Rather, it is used to create a temporary "nonexistent user" for
1749 * later addition to the database. It can also be used to set the IP
1750 * address for an anonymous user to something other than the current
1751 * remote IP.
1753 * @note User::newFromName() has roughly the same function, when the named user
1754 * does not exist.
1755 * @param string $str New user name to set
1757 public function setName( $str ) {
1758 $this->load();
1759 $this->mName = $str;
1763 * Get the user's name escaped by underscores.
1764 * @return String Username escaped by underscores.
1766 public function getTitleKey() {
1767 return str_replace( ' ', '_', $this->getName() );
1771 * Check if the user has new messages.
1772 * @return Bool True if the user has new messages
1774 public function getNewtalk() {
1775 $this->load();
1777 # Load the newtalk status if it is unloaded (mNewtalk=-1)
1778 if ( $this->mNewtalk === -1 ) {
1779 $this->mNewtalk = false; # reset talk page status
1781 # Check memcached separately for anons, who have no
1782 # entire User object stored in there.
1783 if ( !$this->mId ) {
1784 global $wgDisableAnonTalk;
1785 if ( $wgDisableAnonTalk ) {
1786 // Anon newtalk disabled by configuration.
1787 $this->mNewtalk = false;
1788 } else {
1789 global $wgMemc;
1790 $key = wfMemcKey( 'newtalk', 'ip', $this->getName() );
1791 $newtalk = $wgMemc->get( $key );
1792 if ( strval( $newtalk ) !== '' ) {
1793 $this->mNewtalk = (bool)$newtalk;
1794 } else {
1795 // Since we are caching this, make sure it is up to date by getting it
1796 // from the master
1797 $this->mNewtalk = $this->checkNewtalk( 'user_ip', $this->getName(), true );
1798 $wgMemc->set( $key, (int)$this->mNewtalk, 1800 );
1801 } else {
1802 $this->mNewtalk = $this->checkNewtalk( 'user_id', $this->mId );
1806 return (bool)$this->mNewtalk;
1810 * Return the talk page(s) this user has new messages on.
1811 * @return Array of String page URLs
1813 public function getNewMessageLinks() {
1814 $talks = array();
1815 if ( !wfRunHooks( 'UserRetrieveNewTalks', array( &$this, &$talks ) ) ) {
1816 return $talks;
1817 } elseif ( !$this->getNewtalk() ) {
1818 return array();
1820 $utp = $this->getTalkPage();
1821 $dbr = wfGetDB( DB_SLAVE );
1822 // Get the "last viewed rev" timestamp from the oldest message notification
1823 $timestamp = $dbr->selectField( 'user_newtalk',
1824 'MIN(user_last_timestamp)',
1825 $this->isAnon() ? array( 'user_ip' => $this->getName() ) : array( 'user_id' => $this->getID() ),
1826 __METHOD__ );
1827 $rev = $timestamp ? Revision::loadFromTimestamp( $dbr, $utp, $timestamp ) : null;
1828 return array( array( 'wiki' => wfWikiID(), 'link' => $utp->getLocalURL(), 'rev' => $rev ) );
1832 * Internal uncached check for new messages
1834 * @see getNewtalk()
1835 * @param string $field 'user_ip' for anonymous users, 'user_id' otherwise
1836 * @param string|Int $id User's IP address for anonymous users, User ID otherwise
1837 * @param bool $fromMaster true to fetch from the master, false for a slave
1838 * @return Bool True if the user has new messages
1840 protected function checkNewtalk( $field, $id, $fromMaster = false ) {
1841 if ( $fromMaster ) {
1842 $db = wfGetDB( DB_MASTER );
1843 } else {
1844 $db = wfGetDB( DB_SLAVE );
1846 $ok = $db->selectField( 'user_newtalk', $field,
1847 array( $field => $id ), __METHOD__ );
1848 return $ok !== false;
1852 * Add or update the new messages flag
1853 * @param string $field 'user_ip' for anonymous users, 'user_id' otherwise
1854 * @param string|Int $id User's IP address for anonymous users, User ID otherwise
1855 * @param $curRev Revision new, as yet unseen revision of the user talk page. Ignored if null.
1856 * @return Bool True if successful, false otherwise
1858 protected function updateNewtalk( $field, $id, $curRev = null ) {
1859 // Get timestamp of the talk page revision prior to the current one
1860 $prevRev = $curRev ? $curRev->getPrevious() : false;
1861 $ts = $prevRev ? $prevRev->getTimestamp() : null;
1862 // Mark the user as having new messages since this revision
1863 $dbw = wfGetDB( DB_MASTER );
1864 $dbw->insert( 'user_newtalk',
1865 array( $field => $id, 'user_last_timestamp' => $dbw->timestampOrNull( $ts ) ),
1866 __METHOD__,
1867 'IGNORE' );
1868 if ( $dbw->affectedRows() ) {
1869 wfDebug( __METHOD__ . ": set on ($field, $id)\n" );
1870 return true;
1871 } else {
1872 wfDebug( __METHOD__ . " already set ($field, $id)\n" );
1873 return false;
1878 * Clear the new messages flag for the given user
1879 * @param string $field 'user_ip' for anonymous users, 'user_id' otherwise
1880 * @param string|Int $id User's IP address for anonymous users, User ID otherwise
1881 * @return Bool True if successful, false otherwise
1883 protected function deleteNewtalk( $field, $id ) {
1884 $dbw = wfGetDB( DB_MASTER );
1885 $dbw->delete( 'user_newtalk',
1886 array( $field => $id ),
1887 __METHOD__ );
1888 if ( $dbw->affectedRows() ) {
1889 wfDebug( __METHOD__ . ": killed on ($field, $id)\n" );
1890 return true;
1891 } else {
1892 wfDebug( __METHOD__ . ": already gone ($field, $id)\n" );
1893 return false;
1898 * Update the 'You have new messages!' status.
1899 * @param bool $val Whether the user has new messages
1900 * @param $curRev Revision new, as yet unseen revision of the user talk page. Ignored if null or !$val.
1902 public function setNewtalk( $val, $curRev = null ) {
1903 if ( wfReadOnly() ) {
1904 return;
1907 $this->load();
1908 $this->mNewtalk = $val;
1910 if ( $this->isAnon() ) {
1911 $field = 'user_ip';
1912 $id = $this->getName();
1913 } else {
1914 $field = 'user_id';
1915 $id = $this->getId();
1917 global $wgMemc;
1919 if ( $val ) {
1920 $changed = $this->updateNewtalk( $field, $id, $curRev );
1921 } else {
1922 $changed = $this->deleteNewtalk( $field, $id );
1925 if ( $this->isAnon() ) {
1926 // Anons have a separate memcached space, since
1927 // user records aren't kept for them.
1928 $key = wfMemcKey( 'newtalk', 'ip', $id );
1929 $wgMemc->set( $key, $val ? 1 : 0, 1800 );
1931 if ( $changed ) {
1932 $this->invalidateCache();
1937 * Generate a current or new-future timestamp to be stored in the
1938 * user_touched field when we update things.
1939 * @return String Timestamp in TS_MW format
1941 private static function newTouchedTimestamp() {
1942 global $wgClockSkewFudge;
1943 return wfTimestamp( TS_MW, time() + $wgClockSkewFudge );
1947 * Clear user data from memcached.
1948 * Use after applying fun updates to the database; caller's
1949 * responsibility to update user_touched if appropriate.
1951 * Called implicitly from invalidateCache() and saveSettings().
1953 private function clearSharedCache() {
1954 $this->load();
1955 if ( $this->mId ) {
1956 global $wgMemc;
1957 $wgMemc->delete( wfMemcKey( 'user', 'id', $this->mId ) );
1962 * Immediately touch the user data cache for this account.
1963 * Updates user_touched field, and removes account data from memcached
1964 * for reload on the next hit.
1966 public function invalidateCache() {
1967 if ( wfReadOnly() ) {
1968 return;
1970 $this->load();
1971 if ( $this->mId ) {
1972 $this->mTouched = self::newTouchedTimestamp();
1974 $dbw = wfGetDB( DB_MASTER );
1975 $userid = $this->mId;
1976 $touched = $this->mTouched;
1977 $method = __METHOD__;
1978 $dbw->onTransactionIdle( function() use ( $dbw, $userid, $touched, $method ) {
1979 // Prevent contention slams by checking user_touched first
1980 $encTouched = $dbw->addQuotes( $dbw->timestamp( $touched ) );
1981 $needsPurge = $dbw->selectField( 'user', '1',
1982 array( 'user_id' => $userid, 'user_touched < ' . $encTouched ) );
1983 if ( $needsPurge ) {
1984 $dbw->update( 'user',
1985 array( 'user_touched' => $dbw->timestamp( $touched ) ),
1986 array( 'user_id' => $userid, 'user_touched < ' . $encTouched ),
1987 $method
1990 } );
1991 $this->clearSharedCache();
1996 * Validate the cache for this account.
1997 * @param string $timestamp A timestamp in TS_MW format
1999 * @return bool
2001 public function validateCache( $timestamp ) {
2002 $this->load();
2003 return ( $timestamp >= $this->mTouched );
2007 * Get the user touched timestamp
2008 * @return String timestamp
2010 public function getTouched() {
2011 $this->load();
2012 return $this->mTouched;
2016 * Set the password and reset the random token.
2017 * Calls through to authentication plugin if necessary;
2018 * will have no effect if the auth plugin refuses to
2019 * pass the change through or if the legal password
2020 * checks fail.
2022 * As a special case, setting the password to null
2023 * wipes it, so the account cannot be logged in until
2024 * a new password is set, for instance via e-mail.
2026 * @param string $str New password to set
2027 * @throws PasswordError on failure
2029 * @return bool
2031 public function setPassword( $str ) {
2032 global $wgAuth;
2034 if ( $str !== null ) {
2035 if ( !$wgAuth->allowPasswordChange() ) {
2036 throw new PasswordError( wfMessage( 'password-change-forbidden' )->text() );
2039 if ( !$this->isValidPassword( $str ) ) {
2040 global $wgMinimalPasswordLength;
2041 $valid = $this->getPasswordValidity( $str );
2042 if ( is_array( $valid ) ) {
2043 $message = array_shift( $valid );
2044 $params = $valid;
2045 } else {
2046 $message = $valid;
2047 $params = array( $wgMinimalPasswordLength );
2049 throw new PasswordError( wfMessage( $message, $params )->text() );
2053 if ( !$wgAuth->setPassword( $this, $str ) ) {
2054 throw new PasswordError( wfMessage( 'externaldberror' )->text() );
2057 $this->setInternalPassword( $str );
2059 return true;
2063 * Set the password and reset the random token unconditionally.
2065 * @param string|null $str New password to set or null to set an invalid
2066 * password hash meaning that the user will not be able to log in
2067 * through the web interface.
2069 public function setInternalPassword( $str ) {
2070 $this->load();
2071 $this->setToken();
2073 if ( $str === null ) {
2074 // Save an invalid hash...
2075 $this->mPassword = '';
2076 } else {
2077 $this->mPassword = self::crypt( $str );
2079 $this->mNewpassword = '';
2080 $this->mNewpassTime = null;
2084 * Get the user's current token.
2085 * @param bool $forceCreation Force the generation of a new token if the user doesn't have one (default=true for backwards compatibility)
2086 * @return String Token
2088 public function getToken( $forceCreation = true ) {
2089 $this->load();
2090 if ( !$this->mToken && $forceCreation ) {
2091 $this->setToken();
2093 return $this->mToken;
2097 * Set the random token (used for persistent authentication)
2098 * Called from loadDefaults() among other places.
2100 * @param string|bool $token If specified, set the token to this value
2102 public function setToken( $token = false ) {
2103 $this->load();
2104 if ( !$token ) {
2105 $this->mToken = MWCryptRand::generateHex( USER_TOKEN_LENGTH );
2106 } else {
2107 $this->mToken = $token;
2112 * Set the password for a password reminder or new account email
2114 * @param string $str New password to set
2115 * @param bool $throttle If true, reset the throttle timestamp to the present
2117 public function setNewpassword( $str, $throttle = true ) {
2118 $this->load();
2119 $this->mNewpassword = self::crypt( $str );
2120 if ( $throttle ) {
2121 $this->mNewpassTime = wfTimestampNow();
2126 * Has password reminder email been sent within the last
2127 * $wgPasswordReminderResendTime hours?
2128 * @return Bool
2130 public function isPasswordReminderThrottled() {
2131 global $wgPasswordReminderResendTime;
2132 $this->load();
2133 if ( !$this->mNewpassTime || !$wgPasswordReminderResendTime ) {
2134 return false;
2136 $expiry = wfTimestamp( TS_UNIX, $this->mNewpassTime ) + $wgPasswordReminderResendTime * 3600;
2137 return time() < $expiry;
2141 * Get the user's e-mail address
2142 * @return String User's email address
2144 public function getEmail() {
2145 $this->load();
2146 wfRunHooks( 'UserGetEmail', array( $this, &$this->mEmail ) );
2147 return $this->mEmail;
2151 * Get the timestamp of the user's e-mail authentication
2152 * @return String TS_MW timestamp
2154 public function getEmailAuthenticationTimestamp() {
2155 $this->load();
2156 wfRunHooks( 'UserGetEmailAuthenticationTimestamp', array( $this, &$this->mEmailAuthenticated ) );
2157 return $this->mEmailAuthenticated;
2161 * Set the user's e-mail address
2162 * @param string $str New e-mail address
2164 public function setEmail( $str ) {
2165 $this->load();
2166 if ( $str == $this->mEmail ) {
2167 return;
2169 $this->mEmail = $str;
2170 $this->invalidateEmail();
2171 wfRunHooks( 'UserSetEmail', array( $this, &$this->mEmail ) );
2175 * Set the user's e-mail address and a confirmation mail if needed.
2177 * @since 1.20
2178 * @param string $str New e-mail address
2179 * @return Status
2181 public function setEmailWithConfirmation( $str ) {
2182 global $wgEnableEmail, $wgEmailAuthentication;
2184 if ( !$wgEnableEmail ) {
2185 return Status::newFatal( 'emaildisabled' );
2188 $oldaddr = $this->getEmail();
2189 if ( $str === $oldaddr ) {
2190 return Status::newGood( true );
2193 $this->setEmail( $str );
2195 if ( $str !== '' && $wgEmailAuthentication ) {
2196 # Send a confirmation request to the new address if needed
2197 $type = $oldaddr != '' ? 'changed' : 'set';
2198 $result = $this->sendConfirmationMail( $type );
2199 if ( $result->isGood() ) {
2200 # Say the the caller that a confirmation mail has been sent
2201 $result->value = 'eauth';
2203 } else {
2204 $result = Status::newGood( true );
2207 return $result;
2211 * Get the user's real name
2212 * @return String User's real name
2214 public function getRealName() {
2215 if ( !$this->isItemLoaded( 'realname' ) ) {
2216 $this->load();
2219 return $this->mRealName;
2223 * Set the user's real name
2224 * @param string $str New real name
2226 public function setRealName( $str ) {
2227 $this->load();
2228 $this->mRealName = $str;
2232 * Get the user's current setting for a given option.
2234 * @param string $oname The option to check
2235 * @param string $defaultOverride A default value returned if the option does not exist
2236 * @param bool $ignoreHidden = whether to ignore the effects of $wgHiddenPrefs
2237 * @return String User's current value for the option
2238 * @see getBoolOption()
2239 * @see getIntOption()
2241 public function getOption( $oname, $defaultOverride = null, $ignoreHidden = false ) {
2242 global $wgHiddenPrefs;
2243 $this->loadOptions();
2245 # We want 'disabled' preferences to always behave as the default value for
2246 # users, even if they have set the option explicitly in their settings (ie they
2247 # set it, and then it was disabled removing their ability to change it). But
2248 # we don't want to erase the preferences in the database in case the preference
2249 # is re-enabled again. So don't touch $mOptions, just override the returned value
2250 if ( in_array( $oname, $wgHiddenPrefs ) && !$ignoreHidden ) {
2251 return self::getDefaultOption( $oname );
2254 if ( array_key_exists( $oname, $this->mOptions ) ) {
2255 return $this->mOptions[$oname];
2256 } else {
2257 return $defaultOverride;
2262 * Get all user's options
2264 * @return array
2266 public function getOptions() {
2267 global $wgHiddenPrefs;
2268 $this->loadOptions();
2269 $options = $this->mOptions;
2271 # We want 'disabled' preferences to always behave as the default value for
2272 # users, even if they have set the option explicitly in their settings (ie they
2273 # set it, and then it was disabled removing their ability to change it). But
2274 # we don't want to erase the preferences in the database in case the preference
2275 # is re-enabled again. So don't touch $mOptions, just override the returned value
2276 foreach ( $wgHiddenPrefs as $pref ) {
2277 $default = self::getDefaultOption( $pref );
2278 if ( $default !== null ) {
2279 $options[$pref] = $default;
2283 return $options;
2287 * Get the user's current setting for a given option, as a boolean value.
2289 * @param string $oname The option to check
2290 * @return Bool User's current value for the option
2291 * @see getOption()
2293 public function getBoolOption( $oname ) {
2294 return (bool)$this->getOption( $oname );
2298 * Get the user's current setting for a given option, as a boolean value.
2300 * @param string $oname The option to check
2301 * @param int $defaultOverride A default value returned if the option does not exist
2302 * @return Int User's current value for the option
2303 * @see getOption()
2305 public function getIntOption( $oname, $defaultOverride = 0 ) {
2306 $val = $this->getOption( $oname );
2307 if ( $val == '' ) {
2308 $val = $defaultOverride;
2310 return intval( $val );
2314 * Set the given option for a user.
2316 * @param string $oname The option to set
2317 * @param $val mixed New value to set
2319 public function setOption( $oname, $val ) {
2320 $this->loadOptions();
2322 // Explicitly NULL values should refer to defaults
2323 if ( is_null( $val ) ) {
2324 $val = self::getDefaultOption( $oname );
2327 $this->mOptions[$oname] = $val;
2331 * Return a list of the types of user options currently returned by
2332 * User::getOptionKinds().
2334 * Currently, the option kinds are:
2335 * - 'registered' - preferences which are registered in core MediaWiki or
2336 * by extensions using the UserGetDefaultOptions hook.
2337 * - 'registered-multiselect' - as above, using the 'multiselect' type.
2338 * - 'registered-checkmatrix' - as above, using the 'checkmatrix' type.
2339 * - 'userjs' - preferences with names starting with 'userjs-', intended to
2340 * be used by user scripts.
2341 * - 'unused' - preferences about which MediaWiki doesn't know anything.
2342 * These are usually legacy options, removed in newer versions.
2344 * The API (and possibly others) use this function to determine the possible
2345 * option types for validation purposes, so make sure to update this when a
2346 * new option kind is added.
2348 * @see User::getOptionKinds
2349 * @return array Option kinds
2351 public static function listOptionKinds() {
2352 return array(
2353 'registered',
2354 'registered-multiselect',
2355 'registered-checkmatrix',
2356 'userjs',
2357 'unused'
2362 * Return an associative array mapping preferences keys to the kind of a preference they're
2363 * used for. Different kinds are handled differently when setting or reading preferences.
2365 * See User::listOptionKinds for the list of valid option types that can be provided.
2367 * @see User::listOptionKinds
2368 * @param $context IContextSource
2369 * @param array $options assoc. array with options keys to check as keys. Defaults to $this->mOptions.
2370 * @return array the key => kind mapping data
2372 public function getOptionKinds( IContextSource $context, $options = null ) {
2373 $this->loadOptions();
2374 if ( $options === null ) {
2375 $options = $this->mOptions;
2378 $prefs = Preferences::getPreferences( $this, $context );
2379 $mapping = array();
2381 // Multiselect and checkmatrix options are stored in the database with
2382 // one key per option, each having a boolean value. Extract those keys.
2383 $multiselectOptions = array();
2384 foreach ( $prefs as $name => $info ) {
2385 if ( ( isset( $info['type'] ) && $info['type'] == 'multiselect' ) ||
2386 ( isset( $info['class'] ) && $info['class'] == 'HTMLMultiSelectField' ) ) {
2387 $opts = HTMLFormField::flattenOptions( $info['options'] );
2388 $prefix = isset( $info['prefix'] ) ? $info['prefix'] : $name;
2390 foreach ( $opts as $value ) {
2391 $multiselectOptions["$prefix$value"] = true;
2394 unset( $prefs[$name] );
2397 $checkmatrixOptions = array();
2398 foreach ( $prefs as $name => $info ) {
2399 if ( ( isset( $info['type'] ) && $info['type'] == 'checkmatrix' ) ||
2400 ( isset( $info['class'] ) && $info['class'] == 'HTMLCheckMatrix' ) ) {
2401 $columns = HTMLFormField::flattenOptions( $info['columns'] );
2402 $rows = HTMLFormField::flattenOptions( $info['rows'] );
2403 $prefix = isset( $info['prefix'] ) ? $info['prefix'] : $name;
2405 foreach ( $columns as $column ) {
2406 foreach ( $rows as $row ) {
2407 $checkmatrixOptions["$prefix-$column-$row"] = true;
2411 unset( $prefs[$name] );
2415 // $value is ignored
2416 foreach ( $options as $key => $value ) {
2417 if ( isset( $prefs[$key] ) ) {
2418 $mapping[$key] = 'registered';
2419 } elseif ( isset( $multiselectOptions[$key] ) ) {
2420 $mapping[$key] = 'registered-multiselect';
2421 } elseif ( isset( $checkmatrixOptions[$key] ) ) {
2422 $mapping[$key] = 'registered-checkmatrix';
2423 } elseif ( substr( $key, 0, 7 ) === 'userjs-' ) {
2424 $mapping[$key] = 'userjs';
2425 } else {
2426 $mapping[$key] = 'unused';
2430 return $mapping;
2434 * Reset certain (or all) options to the site defaults
2436 * The optional parameter determines which kinds of preferences will be reset.
2437 * Supported values are everything that can be reported by getOptionKinds()
2438 * and 'all', which forces a reset of *all* preferences and overrides everything else.
2440 * @param array|string $resetKinds which kinds of preferences to reset. Defaults to
2441 * array( 'registered', 'registered-multiselect', 'registered-checkmatrix', 'unused' )
2442 * for backwards-compatibility.
2443 * @param $context IContextSource|null context source used when $resetKinds
2444 * does not contain 'all', passed to getOptionKinds().
2445 * Defaults to RequestContext::getMain() when null.
2447 public function resetOptions(
2448 $resetKinds = array( 'registered', 'registered-multiselect', 'registered-checkmatrix', 'unused' ),
2449 IContextSource $context = null
2451 $this->load();
2452 $defaultOptions = self::getDefaultOptions();
2454 if ( !is_array( $resetKinds ) ) {
2455 $resetKinds = array( $resetKinds );
2458 if ( in_array( 'all', $resetKinds ) ) {
2459 $newOptions = $defaultOptions;
2460 } else {
2461 if ( $context === null ) {
2462 $context = RequestContext::getMain();
2465 $optionKinds = $this->getOptionKinds( $context );
2466 $resetKinds = array_intersect( $resetKinds, self::listOptionKinds() );
2467 $newOptions = array();
2469 // Use default values for the options that should be deleted, and
2470 // copy old values for the ones that shouldn't.
2471 foreach ( $this->mOptions as $key => $value ) {
2472 if ( in_array( $optionKinds[$key], $resetKinds ) ) {
2473 if ( array_key_exists( $key, $defaultOptions ) ) {
2474 $newOptions[$key] = $defaultOptions[$key];
2476 } else {
2477 $newOptions[$key] = $value;
2482 $this->mOptions = $newOptions;
2483 $this->mOptionsLoaded = true;
2487 * Get the user's preferred date format.
2488 * @return String User's preferred date format
2490 public function getDatePreference() {
2491 // Important migration for old data rows
2492 if ( is_null( $this->mDatePreference ) ) {
2493 global $wgLang;
2494 $value = $this->getOption( 'date' );
2495 $map = $wgLang->getDatePreferenceMigrationMap();
2496 if ( isset( $map[$value] ) ) {
2497 $value = $map[$value];
2499 $this->mDatePreference = $value;
2501 return $this->mDatePreference;
2505 * Get the user preferred stub threshold
2507 * @return int
2509 public function getStubThreshold() {
2510 global $wgMaxArticleSize; # Maximum article size, in Kb
2511 $threshold = $this->getIntOption( 'stubthreshold' );
2512 if ( $threshold > $wgMaxArticleSize * 1024 ) {
2513 # If they have set an impossible value, disable the preference
2514 # so we can use the parser cache again.
2515 $threshold = 0;
2517 return $threshold;
2521 * Get the permissions this user has.
2522 * @return Array of String permission names
2524 public function getRights() {
2525 if ( is_null( $this->mRights ) ) {
2526 $this->mRights = self::getGroupPermissions( $this->getEffectiveGroups() );
2527 wfRunHooks( 'UserGetRights', array( $this, &$this->mRights ) );
2528 // Force reindexation of rights when a hook has unset one of them
2529 $this->mRights = array_values( array_unique( $this->mRights ) );
2531 return $this->mRights;
2535 * Get the list of explicit group memberships this user has.
2536 * The implicit * and user groups are not included.
2537 * @return Array of String internal group names
2539 public function getGroups() {
2540 $this->load();
2541 $this->loadGroups();
2542 return $this->mGroups;
2546 * Get the list of implicit group memberships this user has.
2547 * This includes all explicit groups, plus 'user' if logged in,
2548 * '*' for all accounts, and autopromoted groups
2549 * @param bool $recache Whether to avoid the cache
2550 * @return Array of String internal group names
2552 public function getEffectiveGroups( $recache = false ) {
2553 if ( $recache || is_null( $this->mEffectiveGroups ) ) {
2554 wfProfileIn( __METHOD__ );
2555 $this->mEffectiveGroups = array_unique( array_merge(
2556 $this->getGroups(), // explicit groups
2557 $this->getAutomaticGroups( $recache ) // implicit groups
2558 ) );
2559 # Hook for additional groups
2560 wfRunHooks( 'UserEffectiveGroups', array( &$this, &$this->mEffectiveGroups ) );
2561 // Force reindexation of groups when a hook has unset one of them
2562 $this->mEffectiveGroups = array_values( array_unique( $this->mEffectiveGroups ) );
2563 wfProfileOut( __METHOD__ );
2565 return $this->mEffectiveGroups;
2569 * Get the list of implicit group memberships this user has.
2570 * This includes 'user' if logged in, '*' for all accounts,
2571 * and autopromoted groups
2572 * @param bool $recache Whether to avoid the cache
2573 * @return Array of String internal group names
2575 public function getAutomaticGroups( $recache = false ) {
2576 if ( $recache || is_null( $this->mImplicitGroups ) ) {
2577 wfProfileIn( __METHOD__ );
2578 $this->mImplicitGroups = array( '*' );
2579 if ( $this->getId() ) {
2580 $this->mImplicitGroups[] = 'user';
2582 $this->mImplicitGroups = array_unique( array_merge(
2583 $this->mImplicitGroups,
2584 Autopromote::getAutopromoteGroups( $this )
2585 ) );
2587 if ( $recache ) {
2588 # Assure data consistency with rights/groups,
2589 # as getEffectiveGroups() depends on this function
2590 $this->mEffectiveGroups = null;
2592 wfProfileOut( __METHOD__ );
2594 return $this->mImplicitGroups;
2598 * Returns the groups the user has belonged to.
2600 * The user may still belong to the returned groups. Compare with getGroups().
2602 * The function will not return groups the user had belonged to before MW 1.17
2604 * @return array Names of the groups the user has belonged to.
2606 public function getFormerGroups() {
2607 if ( is_null( $this->mFormerGroups ) ) {
2608 $dbr = wfGetDB( DB_MASTER );
2609 $res = $dbr->select( 'user_former_groups',
2610 array( 'ufg_group' ),
2611 array( 'ufg_user' => $this->mId ),
2612 __METHOD__ );
2613 $this->mFormerGroups = array();
2614 foreach ( $res as $row ) {
2615 $this->mFormerGroups[] = $row->ufg_group;
2618 return $this->mFormerGroups;
2622 * Get the user's edit count.
2623 * @return Int
2625 public function getEditCount() {
2626 if ( !$this->getId() ) {
2627 return null;
2630 if ( !isset( $this->mEditCount ) ) {
2631 /* Populate the count, if it has not been populated yet */
2632 wfProfileIn( __METHOD__ );
2633 $dbr = wfGetDB( DB_SLAVE );
2634 // check if the user_editcount field has been initialized
2635 $count = $dbr->selectField(
2636 'user', 'user_editcount',
2637 array( 'user_id' => $this->mId ),
2638 __METHOD__
2641 if ( $count === null ) {
2642 // it has not been initialized. do so.
2643 $count = $this->initEditCount();
2645 $this->mEditCount = intval( $count );
2646 wfProfileOut( __METHOD__ );
2648 return $this->mEditCount;
2652 * Add the user to the given group.
2653 * This takes immediate effect.
2654 * @param string $group Name of the group to add
2656 public function addGroup( $group ) {
2657 if ( wfRunHooks( 'UserAddGroup', array( $this, &$group ) ) ) {
2658 $dbw = wfGetDB( DB_MASTER );
2659 if ( $this->getId() ) {
2660 $dbw->insert( 'user_groups',
2661 array(
2662 'ug_user' => $this->getID(),
2663 'ug_group' => $group,
2665 __METHOD__,
2666 array( 'IGNORE' ) );
2669 $this->loadGroups();
2670 $this->mGroups[] = $group;
2671 // In case loadGroups was not called before, we now have the right twice.
2672 // Get rid of the duplicate.
2673 $this->mGroups = array_unique( $this->mGroups );
2674 $this->mRights = User::getGroupPermissions( $this->getEffectiveGroups( true ) );
2676 $this->invalidateCache();
2680 * Remove the user from the given group.
2681 * This takes immediate effect.
2682 * @param string $group Name of the group to remove
2684 public function removeGroup( $group ) {
2685 $this->load();
2686 if ( wfRunHooks( 'UserRemoveGroup', array( $this, &$group ) ) ) {
2687 $dbw = wfGetDB( DB_MASTER );
2688 $dbw->delete( 'user_groups',
2689 array(
2690 'ug_user' => $this->getID(),
2691 'ug_group' => $group,
2692 ), __METHOD__ );
2693 // Remember that the user was in this group
2694 $dbw->insert( 'user_former_groups',
2695 array(
2696 'ufg_user' => $this->getID(),
2697 'ufg_group' => $group,
2699 __METHOD__,
2700 array( 'IGNORE' ) );
2702 $this->loadGroups();
2703 $this->mGroups = array_diff( $this->mGroups, array( $group ) );
2704 $this->mRights = User::getGroupPermissions( $this->getEffectiveGroups( true ) );
2706 $this->invalidateCache();
2710 * Get whether the user is logged in
2711 * @return Bool
2713 public function isLoggedIn() {
2714 return $this->getID() != 0;
2718 * Get whether the user is anonymous
2719 * @return Bool
2721 public function isAnon() {
2722 return !$this->isLoggedIn();
2726 * Check if user is allowed to access a feature / make an action
2728 * @internal param \String $varargs permissions to test
2729 * @return Boolean: True if user is allowed to perform *any* of the given actions
2731 * @return bool
2733 public function isAllowedAny( /*...*/ ) {
2734 $permissions = func_get_args();
2735 foreach ( $permissions as $permission ) {
2736 if ( $this->isAllowed( $permission ) ) {
2737 return true;
2740 return false;
2745 * @internal param $varargs string
2746 * @return bool True if the user is allowed to perform *all* of the given actions
2748 public function isAllowedAll( /*...*/ ) {
2749 $permissions = func_get_args();
2750 foreach ( $permissions as $permission ) {
2751 if ( !$this->isAllowed( $permission ) ) {
2752 return false;
2755 return true;
2759 * Internal mechanics of testing a permission
2760 * @param $action String
2761 * @return bool
2763 public function isAllowed( $action = '' ) {
2764 if ( $action === '' ) {
2765 return true; // In the spirit of DWIM
2767 # Patrolling may not be enabled
2768 if ( $action === 'patrol' || $action === 'autopatrol' ) {
2769 global $wgUseRCPatrol, $wgUseNPPatrol;
2770 if ( !$wgUseRCPatrol && !$wgUseNPPatrol ) {
2771 return false;
2774 # Use strict parameter to avoid matching numeric 0 accidentally inserted
2775 # by misconfiguration: 0 == 'foo'
2776 return in_array( $action, $this->getRights(), true );
2780 * Check whether to enable recent changes patrol features for this user
2781 * @return Boolean: True or false
2783 public function useRCPatrol() {
2784 global $wgUseRCPatrol;
2785 return $wgUseRCPatrol && $this->isAllowedAny( 'patrol', 'patrolmarks' );
2789 * Check whether to enable new pages patrol features for this user
2790 * @return Bool True or false
2792 public function useNPPatrol() {
2793 global $wgUseRCPatrol, $wgUseNPPatrol;
2794 return ( ( $wgUseRCPatrol || $wgUseNPPatrol ) && ( $this->isAllowedAny( 'patrol', 'patrolmarks' ) ) );
2798 * Get the WebRequest object to use with this object
2800 * @return WebRequest
2802 public function getRequest() {
2803 if ( $this->mRequest ) {
2804 return $this->mRequest;
2805 } else {
2806 global $wgRequest;
2807 return $wgRequest;
2812 * Get the current skin, loading it if required
2813 * @return Skin The current skin
2814 * @todo FIXME: Need to check the old failback system [AV]
2815 * @deprecated since 1.18 Use ->getSkin() in the most relevant outputting context you have
2817 public function getSkin() {
2818 wfDeprecated( __METHOD__, '1.18' );
2819 return RequestContext::getMain()->getSkin();
2823 * Get a WatchedItem for this user and $title.
2825 * @param $title Title
2826 * @return WatchedItem
2828 public function getWatchedItem( $title ) {
2829 $key = $title->getNamespace() . ':' . $title->getDBkey();
2831 if ( isset( $this->mWatchedItems[$key] ) ) {
2832 return $this->mWatchedItems[$key];
2835 if ( count( $this->mWatchedItems ) >= self::MAX_WATCHED_ITEMS_CACHE ) {
2836 $this->mWatchedItems = array();
2839 $this->mWatchedItems[$key] = WatchedItem::fromUserTitle( $this, $title );
2840 return $this->mWatchedItems[$key];
2844 * Check the watched status of an article.
2845 * @param $title Title of the article to look at
2846 * @return Bool
2848 public function isWatched( $title ) {
2849 return $this->getWatchedItem( $title )->isWatched();
2853 * Watch an article.
2854 * @param $title Title of the article to look at
2856 public function addWatch( $title ) {
2857 $this->getWatchedItem( $title )->addWatch();
2858 $this->invalidateCache();
2862 * Stop watching an article.
2863 * @param $title Title of the article to look at
2865 public function removeWatch( $title ) {
2866 $this->getWatchedItem( $title )->removeWatch();
2867 $this->invalidateCache();
2871 * Clear the user's notification timestamp for the given title.
2872 * If e-notif e-mails are on, they will receive notification mails on
2873 * the next change of the page if it's watched etc.
2874 * @param $title Title of the article to look at
2876 public function clearNotification( &$title ) {
2877 global $wgUseEnotif, $wgShowUpdatedMarker;
2879 # Do nothing if the database is locked to writes
2880 if ( wfReadOnly() ) {
2881 return;
2884 if ( $title->getNamespace() == NS_USER_TALK &&
2885 $title->getText() == $this->getName() ) {
2886 if ( !wfRunHooks( 'UserClearNewTalkNotification', array( &$this ) ) ) {
2887 return;
2889 $this->setNewtalk( false );
2892 if ( !$wgUseEnotif && !$wgShowUpdatedMarker ) {
2893 return;
2896 if ( $this->isAnon() ) {
2897 // Nothing else to do...
2898 return;
2901 // Only update the timestamp if the page is being watched.
2902 // The query to find out if it is watched is cached both in memcached and per-invocation,
2903 // and when it does have to be executed, it can be on a slave
2904 // If this is the user's newtalk page, we always update the timestamp
2905 $force = '';
2906 if ( $title->getNamespace() == NS_USER_TALK &&
2907 $title->getText() == $this->getName() )
2909 $force = 'force';
2912 $this->getWatchedItem( $title )->resetNotificationTimestamp( $force );
2916 * Resets all of the given user's page-change notification timestamps.
2917 * If e-notif e-mails are on, they will receive notification mails on
2918 * the next change of any watched page.
2920 public function clearAllNotifications() {
2921 if ( wfReadOnly() ) {
2922 return;
2925 global $wgUseEnotif, $wgShowUpdatedMarker;
2926 if ( !$wgUseEnotif && !$wgShowUpdatedMarker ) {
2927 $this->setNewtalk( false );
2928 return;
2930 $id = $this->getId();
2931 if ( $id != 0 ) {
2932 $dbw = wfGetDB( DB_MASTER );
2933 $dbw->update( 'watchlist',
2934 array( /* SET */
2935 'wl_notificationtimestamp' => null
2936 ), array( /* WHERE */
2937 'wl_user' => $id
2938 ), __METHOD__
2940 # We also need to clear here the "you have new message" notification for the own user_talk page
2941 # This is cleared one page view later in Article::viewUpdates();
2946 * Set this user's options from an encoded string
2947 * @param string $str Encoded options to import
2949 * @deprecated in 1.19 due to removal of user_options from the user table
2951 private function decodeOptions( $str ) {
2952 wfDeprecated( __METHOD__, '1.19' );
2953 if ( !$str ) {
2954 return;
2957 $this->mOptionsLoaded = true;
2958 $this->mOptionOverrides = array();
2960 // If an option is not set in $str, use the default value
2961 $this->mOptions = self::getDefaultOptions();
2963 $a = explode( "\n", $str );
2964 foreach ( $a as $s ) {
2965 $m = array();
2966 if ( preg_match( "/^(.[^=]*)=(.*)$/", $s, $m ) ) {
2967 $this->mOptions[$m[1]] = $m[2];
2968 $this->mOptionOverrides[$m[1]] = $m[2];
2974 * Set a cookie on the user's client. Wrapper for
2975 * WebResponse::setCookie
2976 * @param string $name Name of the cookie to set
2977 * @param string $value Value to set
2978 * @param int $exp Expiration time, as a UNIX time value;
2979 * if 0 or not specified, use the default $wgCookieExpiration
2980 * @param $secure Bool
2981 * true: Force setting the secure attribute when setting the cookie
2982 * false: Force NOT setting the secure attribute when setting the cookie
2983 * null (default): Use the default ($wgCookieSecure) to set the secure attribute
2985 protected function setCookie( $name, $value, $exp = 0, $secure = null ) {
2986 $this->getRequest()->response()->setcookie( $name, $value, $exp, null, null, $secure );
2990 * Clear a cookie on the user's client
2991 * @param string $name Name of the cookie to clear
2993 protected function clearCookie( $name ) {
2994 $this->setCookie( $name, '', time() - 86400 );
2998 * Set the default cookies for this session on the user's client.
3000 * @param $request WebRequest object to use; $wgRequest will be used if null
3001 * is passed.
3002 * @param bool $secure Whether to force secure/insecure cookies or use default
3004 public function setCookies( $request = null, $secure = null ) {
3005 if ( $request === null ) {
3006 $request = $this->getRequest();
3009 $this->load();
3010 if ( 0 == $this->mId ) {
3011 return;
3013 if ( !$this->mToken ) {
3014 // When token is empty or NULL generate a new one and then save it to the database
3015 // This allows a wiki to re-secure itself after a leak of it's user table or $wgSecretKey
3016 // Simply by setting every cell in the user_token column to NULL and letting them be
3017 // regenerated as users log back into the wiki.
3018 $this->setToken();
3019 $this->saveSettings();
3021 $session = array(
3022 'wsUserID' => $this->mId,
3023 'wsToken' => $this->mToken,
3024 'wsUserName' => $this->getName()
3026 $cookies = array(
3027 'UserID' => $this->mId,
3028 'UserName' => $this->getName(),
3030 if ( 1 == $this->getOption( 'rememberpassword' ) ) {
3031 $cookies['Token'] = $this->mToken;
3032 } else {
3033 $cookies['Token'] = false;
3036 wfRunHooks( 'UserSetCookies', array( $this, &$session, &$cookies ) );
3038 foreach ( $session as $name => $value ) {
3039 $request->setSessionData( $name, $value );
3041 foreach ( $cookies as $name => $value ) {
3042 if ( $value === false ) {
3043 $this->clearCookie( $name );
3044 } else {
3045 $this->setCookie( $name, $value, 0, $secure );
3050 * If wpStickHTTPS was selected, also set an insecure cookie that
3051 * will cause the site to redirect the user to HTTPS, if they access
3052 * it over HTTP. Bug 29898.
3054 if ( $request->getCheck( 'wpStickHTTPS' ) ) {
3055 $this->setCookie( 'forceHTTPS', 'true', time() + 2592000, false ); //30 days
3060 * Log this user out.
3062 public function logout() {
3063 if ( wfRunHooks( 'UserLogout', array( &$this ) ) ) {
3064 $this->doLogout();
3069 * Clear the user's cookies and session, and reset the instance cache.
3070 * @see logout()
3072 public function doLogout() {
3073 $this->clearInstanceCache( 'defaults' );
3075 $this->getRequest()->setSessionData( 'wsUserID', 0 );
3077 $this->clearCookie( 'UserID' );
3078 $this->clearCookie( 'Token' );
3079 $this->clearCookie( 'forceHTTPS' );
3081 # Remember when user logged out, to prevent seeing cached pages
3082 $this->setCookie( 'LoggedOut', wfTimestampNow(), time() + 86400 );
3086 * Save this user's settings into the database.
3087 * @todo Only rarely do all these fields need to be set!
3089 public function saveSettings() {
3090 global $wgAuth;
3092 $this->load();
3093 if ( wfReadOnly() ) {
3094 return;
3096 if ( 0 == $this->mId ) {
3097 return;
3100 $this->mTouched = self::newTouchedTimestamp();
3101 if ( !$wgAuth->allowSetLocalPassword() ) {
3102 $this->mPassword = '';
3105 $dbw = wfGetDB( DB_MASTER );
3106 $dbw->update( 'user',
3107 array( /* SET */
3108 'user_name' => $this->mName,
3109 'user_password' => $this->mPassword,
3110 'user_newpassword' => $this->mNewpassword,
3111 'user_newpass_time' => $dbw->timestampOrNull( $this->mNewpassTime ),
3112 'user_real_name' => $this->mRealName,
3113 'user_email' => $this->mEmail,
3114 'user_email_authenticated' => $dbw->timestampOrNull( $this->mEmailAuthenticated ),
3115 'user_touched' => $dbw->timestamp( $this->mTouched ),
3116 'user_token' => strval( $this->mToken ),
3117 'user_email_token' => $this->mEmailToken,
3118 'user_email_token_expires' => $dbw->timestampOrNull( $this->mEmailTokenExpires ),
3119 ), array( /* WHERE */
3120 'user_id' => $this->mId
3121 ), __METHOD__
3124 $this->saveOptions();
3126 wfRunHooks( 'UserSaveSettings', array( $this ) );
3127 $this->clearSharedCache();
3128 $this->getUserPage()->invalidateCache();
3132 * If only this user's username is known, and it exists, return the user ID.
3133 * @return Int
3135 public function idForName() {
3136 $s = trim( $this->getName() );
3137 if ( $s === '' ) {
3138 return 0;
3141 $dbr = wfGetDB( DB_SLAVE );
3142 $id = $dbr->selectField( 'user', 'user_id', array( 'user_name' => $s ), __METHOD__ );
3143 if ( $id === false ) {
3144 $id = 0;
3146 return $id;
3150 * Add a user to the database, return the user object
3152 * @param string $name Username to add
3153 * @param array $params of Strings Non-default parameters to save to the database as user_* fields:
3154 * - password The user's password hash. Password logins will be disabled if this is omitted.
3155 * - newpassword Hash for a temporary password that has been mailed to the user
3156 * - email The user's email address
3157 * - email_authenticated The email authentication timestamp
3158 * - real_name The user's real name
3159 * - options An associative array of non-default options
3160 * - token Random authentication token. Do not set.
3161 * - registration Registration timestamp. Do not set.
3163 * @return User object, or null if the username already exists
3165 public static function createNew( $name, $params = array() ) {
3166 $user = new User;
3167 $user->load();
3168 $user->setToken(); // init token
3169 if ( isset( $params['options'] ) ) {
3170 $user->mOptions = $params['options'] + (array)$user->mOptions;
3171 unset( $params['options'] );
3173 $dbw = wfGetDB( DB_MASTER );
3174 $seqVal = $dbw->nextSequenceValue( 'user_user_id_seq' );
3176 $fields = array(
3177 'user_id' => $seqVal,
3178 'user_name' => $name,
3179 'user_password' => $user->mPassword,
3180 'user_newpassword' => $user->mNewpassword,
3181 'user_newpass_time' => $dbw->timestampOrNull( $user->mNewpassTime ),
3182 'user_email' => $user->mEmail,
3183 'user_email_authenticated' => $dbw->timestampOrNull( $user->mEmailAuthenticated ),
3184 'user_real_name' => $user->mRealName,
3185 'user_token' => strval( $user->mToken ),
3186 'user_registration' => $dbw->timestamp( $user->mRegistration ),
3187 'user_editcount' => 0,
3188 'user_touched' => $dbw->timestamp( self::newTouchedTimestamp() ),
3190 foreach ( $params as $name => $value ) {
3191 $fields["user_$name"] = $value;
3193 $dbw->insert( 'user', $fields, __METHOD__, array( 'IGNORE' ) );
3194 if ( $dbw->affectedRows() ) {
3195 $newUser = User::newFromId( $dbw->insertId() );
3196 } else {
3197 $newUser = null;
3199 return $newUser;
3203 * Add this existing user object to the database. If the user already
3204 * exists, a fatal status object is returned, and the user object is
3205 * initialised with the data from the database.
3207 * Previously, this function generated a DB error due to a key conflict
3208 * if the user already existed. Many extension callers use this function
3209 * in code along the lines of:
3211 * $user = User::newFromName( $name );
3212 * if ( !$user->isLoggedIn() ) {
3213 * $user->addToDatabase();
3215 * // do something with $user...
3217 * However, this was vulnerable to a race condition (bug 16020). By
3218 * initialising the user object if the user exists, we aim to support this
3219 * calling sequence as far as possible.
3221 * Note that if the user exists, this function will acquire a write lock,
3222 * so it is still advisable to make the call conditional on isLoggedIn(),
3223 * and to commit the transaction after calling.
3225 * @throws MWException
3226 * @return Status
3228 public function addToDatabase() {
3229 $this->load();
3230 if ( !$this->mToken ) {
3231 $this->setToken(); // init token
3234 $this->mTouched = self::newTouchedTimestamp();
3236 $dbw = wfGetDB( DB_MASTER );
3237 $seqVal = $dbw->nextSequenceValue( 'user_user_id_seq' );
3238 $dbw->insert( 'user',
3239 array(
3240 'user_id' => $seqVal,
3241 'user_name' => $this->mName,
3242 'user_password' => $this->mPassword,
3243 'user_newpassword' => $this->mNewpassword,
3244 'user_newpass_time' => $dbw->timestampOrNull( $this->mNewpassTime ),
3245 'user_email' => $this->mEmail,
3246 'user_email_authenticated' => $dbw->timestampOrNull( $this->mEmailAuthenticated ),
3247 'user_real_name' => $this->mRealName,
3248 'user_token' => strval( $this->mToken ),
3249 'user_registration' => $dbw->timestamp( $this->mRegistration ),
3250 'user_editcount' => 0,
3251 'user_touched' => $dbw->timestamp( $this->mTouched ),
3252 ), __METHOD__,
3253 array( 'IGNORE' )
3255 if ( !$dbw->affectedRows() ) {
3256 $this->mId = $dbw->selectField( 'user', 'user_id',
3257 array( 'user_name' => $this->mName ), __METHOD__ );
3258 $loaded = false;
3259 if ( $this->mId ) {
3260 if ( $this->loadFromDatabase() ) {
3261 $loaded = true;
3264 if ( !$loaded ) {
3265 throw new MWException( __METHOD__ . ": hit a key conflict attempting " .
3266 "to insert user '{$this->mName}' row, but it was not present in select!" );
3268 return Status::newFatal( 'userexists' );
3270 $this->mId = $dbw->insertId();
3272 // Clear instance cache other than user table data, which is already accurate
3273 $this->clearInstanceCache();
3275 $this->saveOptions();
3276 return Status::newGood();
3280 * If this user is logged-in and blocked,
3281 * block any IP address they've successfully logged in from.
3282 * @return bool A block was spread
3284 public function spreadAnyEditBlock() {
3285 if ( $this->isLoggedIn() && $this->isBlocked() ) {
3286 return $this->spreadBlock();
3288 return false;
3292 * If this (non-anonymous) user is blocked,
3293 * block the IP address they've successfully logged in from.
3294 * @return bool A block was spread
3296 protected function spreadBlock() {
3297 wfDebug( __METHOD__ . "()\n" );
3298 $this->load();
3299 if ( $this->mId == 0 ) {
3300 return false;
3303 $userblock = Block::newFromTarget( $this->getName() );
3304 if ( !$userblock ) {
3305 return false;
3308 return (bool)$userblock->doAutoblock( $this->getRequest()->getIP() );
3312 * Generate a string which will be different for any combination of
3313 * user options which would produce different parser output.
3314 * This will be used as part of the hash key for the parser cache,
3315 * so users with the same options can share the same cached data
3316 * safely.
3318 * Extensions which require it should install 'PageRenderingHash' hook,
3319 * which will give them a chance to modify this key based on their own
3320 * settings.
3322 * @deprecated since 1.17 use the ParserOptions object to get the relevant options
3323 * @return String Page rendering hash
3325 public function getPageRenderingHash() {
3326 wfDeprecated( __METHOD__, '1.17' );
3328 global $wgRenderHashAppend, $wgLang, $wgContLang;
3329 if ( $this->mHash ) {
3330 return $this->mHash;
3333 // stubthreshold is only included below for completeness,
3334 // since it disables the parser cache, its value will always
3335 // be 0 when this function is called by parsercache.
3337 $confstr = $this->getOption( 'math' );
3338 $confstr .= '!' . $this->getStubThreshold();
3339 $confstr .= '!' . ( $this->getOption( 'numberheadings' ) ? '1' : '' );
3340 $confstr .= '!' . $wgLang->getCode();
3341 $confstr .= '!' . $this->getOption( 'thumbsize' );
3342 // add in language specific options, if any
3343 $extra = $wgContLang->getExtraHashOptions();
3344 $confstr .= $extra;
3346 // Since the skin could be overloading link(), it should be
3347 // included here but in practice, none of our skins do that.
3349 $confstr .= $wgRenderHashAppend;
3351 // Give a chance for extensions to modify the hash, if they have
3352 // extra options or other effects on the parser cache.
3353 wfRunHooks( 'PageRenderingHash', array( &$confstr ) );
3355 // Make it a valid memcached key fragment
3356 $confstr = str_replace( ' ', '_', $confstr );
3357 $this->mHash = $confstr;
3358 return $confstr;
3362 * Get whether the user is explicitly blocked from account creation.
3363 * @return Bool|Block
3365 public function isBlockedFromCreateAccount() {
3366 $this->getBlockedStatus();
3367 if ( $this->mBlock && $this->mBlock->prevents( 'createaccount' ) ) {
3368 return $this->mBlock;
3371 # bug 13611: if the IP address the user is trying to create an account from is
3372 # blocked with createaccount disabled, prevent new account creation there even
3373 # when the user is logged in
3374 if ( $this->mBlockedFromCreateAccount === false && !$this->isAllowed( 'ipblock-exempt' ) ) {
3375 $this->mBlockedFromCreateAccount = Block::newFromTarget( null, $this->getRequest()->getIP() );
3377 return $this->mBlockedFromCreateAccount instanceof Block && $this->mBlockedFromCreateAccount->prevents( 'createaccount' )
3378 ? $this->mBlockedFromCreateAccount
3379 : false;
3383 * Get whether the user is blocked from using Special:Emailuser.
3384 * @return Bool
3386 public function isBlockedFromEmailuser() {
3387 $this->getBlockedStatus();
3388 return $this->mBlock && $this->mBlock->prevents( 'sendemail' );
3392 * Get whether the user is allowed to create an account.
3393 * @return Bool
3395 function isAllowedToCreateAccount() {
3396 return $this->isAllowed( 'createaccount' ) && !$this->isBlockedFromCreateAccount();
3400 * Get this user's personal page title.
3402 * @return Title: User's personal page title
3404 public function getUserPage() {
3405 return Title::makeTitle( NS_USER, $this->getName() );
3409 * Get this user's talk page title.
3411 * @return Title: User's talk page title
3413 public function getTalkPage() {
3414 $title = $this->getUserPage();
3415 return $title->getTalkPage();
3419 * Determine whether the user is a newbie. Newbies are either
3420 * anonymous IPs, or the most recently created accounts.
3421 * @return Bool
3423 public function isNewbie() {
3424 return !$this->isAllowed( 'autoconfirmed' );
3428 * Check to see if the given clear-text password is one of the accepted passwords
3429 * @param string $password user password.
3430 * @return Boolean: True if the given password is correct, otherwise False.
3432 public function checkPassword( $password ) {
3433 global $wgAuth, $wgLegacyEncoding;
3434 $this->load();
3436 // Even though we stop people from creating passwords that
3437 // are shorter than this, doesn't mean people wont be able
3438 // to. Certain authentication plugins do NOT want to save
3439 // domain passwords in a mysql database, so we should
3440 // check this (in case $wgAuth->strict() is false).
3441 if ( !$this->isValidPassword( $password ) ) {
3442 return false;
3445 if ( $wgAuth->authenticate( $this->getName(), $password ) ) {
3446 return true;
3447 } elseif ( $wgAuth->strict() ) {
3448 /* Auth plugin doesn't allow local authentication */
3449 return false;
3450 } elseif ( $wgAuth->strictUserAuth( $this->getName() ) ) {
3451 /* Auth plugin doesn't allow local authentication for this user name */
3452 return false;
3454 if ( self::comparePasswords( $this->mPassword, $password, $this->mId ) ) {
3455 return true;
3456 } elseif ( $wgLegacyEncoding ) {
3457 # Some wikis were converted from ISO 8859-1 to UTF-8, the passwords can't be converted
3458 # Check for this with iconv
3459 $cp1252Password = iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $password );
3460 if ( $cp1252Password != $password &&
3461 self::comparePasswords( $this->mPassword, $cp1252Password, $this->mId ) )
3463 return true;
3466 return false;
3470 * Check if the given clear-text password matches the temporary password
3471 * sent by e-mail for password reset operations.
3473 * @param $plaintext string
3475 * @return Boolean: True if matches, false otherwise
3477 public function checkTemporaryPassword( $plaintext ) {
3478 global $wgNewPasswordExpiry;
3480 $this->load();
3481 if ( self::comparePasswords( $this->mNewpassword, $plaintext, $this->getId() ) ) {
3482 if ( is_null( $this->mNewpassTime ) ) {
3483 return true;
3485 $expiry = wfTimestamp( TS_UNIX, $this->mNewpassTime ) + $wgNewPasswordExpiry;
3486 return ( time() < $expiry );
3487 } else {
3488 return false;
3493 * Alias for getEditToken.
3494 * @deprecated since 1.19, use getEditToken instead.
3496 * @param string|array $salt of Strings Optional function-specific data for hashing
3497 * @param $request WebRequest object to use or null to use $wgRequest
3498 * @return String The new edit token
3500 public function editToken( $salt = '', $request = null ) {
3501 wfDeprecated( __METHOD__, '1.19' );
3502 return $this->getEditToken( $salt, $request );
3506 * Initialize (if necessary) and return a session token value
3507 * which can be used in edit forms to show that the user's
3508 * login credentials aren't being hijacked with a foreign form
3509 * submission.
3511 * @since 1.19
3513 * @param string|array $salt of Strings Optional function-specific data for hashing
3514 * @param $request WebRequest object to use or null to use $wgRequest
3515 * @return String The new edit token
3517 public function getEditToken( $salt = '', $request = null ) {
3518 if ( $request == null ) {
3519 $request = $this->getRequest();
3522 if ( $this->isAnon() ) {
3523 return EDIT_TOKEN_SUFFIX;
3524 } else {
3525 $token = $request->getSessionData( 'wsEditToken' );
3526 if ( $token === null ) {
3527 $token = MWCryptRand::generateHex( 32 );
3528 $request->setSessionData( 'wsEditToken', $token );
3530 if ( is_array( $salt ) ) {
3531 $salt = implode( '|', $salt );
3533 return md5( $token . $salt ) . EDIT_TOKEN_SUFFIX;
3538 * Generate a looking random token for various uses.
3540 * @return String The new random token
3541 * @deprecated since 1.20; Use MWCryptRand for secure purposes or wfRandomString for pseudo-randomness
3543 public static function generateToken() {
3544 return MWCryptRand::generateHex( 32 );
3548 * Check given value against the token value stored in the session.
3549 * A match should confirm that the form was submitted from the
3550 * user's own login session, not a form submission from a third-party
3551 * site.
3553 * @param string $val Input value to compare
3554 * @param string $salt Optional function-specific data for hashing
3555 * @param $request WebRequest object to use or null to use $wgRequest
3556 * @return Boolean: Whether the token matches
3558 public function matchEditToken( $val, $salt = '', $request = null ) {
3559 $sessionToken = $this->getEditToken( $salt, $request );
3560 if ( $val != $sessionToken ) {
3561 wfDebug( "User::matchEditToken: broken session data\n" );
3563 return $val == $sessionToken;
3567 * Check given value against the token value stored in the session,
3568 * ignoring the suffix.
3570 * @param string $val Input value to compare
3571 * @param string $salt Optional function-specific data for hashing
3572 * @param $request WebRequest object to use or null to use $wgRequest
3573 * @return Boolean: Whether the token matches
3575 public function matchEditTokenNoSuffix( $val, $salt = '', $request = null ) {
3576 $sessionToken = $this->getEditToken( $salt, $request );
3577 return substr( $sessionToken, 0, 32 ) == substr( $val, 0, 32 );
3581 * Generate a new e-mail confirmation token and send a confirmation/invalidation
3582 * mail to the user's given address.
3584 * @param string $type message to send, either "created", "changed" or "set"
3585 * @return Status object
3587 public function sendConfirmationMail( $type = 'created' ) {
3588 global $wgLang;
3589 $expiration = null; // gets passed-by-ref and defined in next line.
3590 $token = $this->confirmationToken( $expiration );
3591 $url = $this->confirmationTokenUrl( $token );
3592 $invalidateURL = $this->invalidationTokenUrl( $token );
3593 $this->saveSettings();
3595 if ( $type == 'created' || $type === false ) {
3596 $message = 'confirmemail_body';
3597 } elseif ( $type === true ) {
3598 $message = 'confirmemail_body_changed';
3599 } else {
3600 $message = 'confirmemail_body_' . $type;
3603 return $this->sendMail( wfMessage( 'confirmemail_subject' )->text(),
3604 wfMessage( $message,
3605 $this->getRequest()->getIP(),
3606 $this->getName(),
3607 $url,
3608 $wgLang->timeanddate( $expiration, false ),
3609 $invalidateURL,
3610 $wgLang->date( $expiration, false ),
3611 $wgLang->time( $expiration, false ) )->text() );
3615 * Send an e-mail to this user's account. Does not check for
3616 * confirmed status or validity.
3618 * @param string $subject Message subject
3619 * @param string $body Message body
3620 * @param string $from Optional From address; if unspecified, default $wgPasswordSender will be used
3621 * @param string $replyto Reply-To address
3622 * @return Status
3624 public function sendMail( $subject, $body, $from = null, $replyto = null ) {
3625 if ( is_null( $from ) ) {
3626 global $wgPasswordSender, $wgPasswordSenderName;
3627 $sender = new MailAddress( $wgPasswordSender, $wgPasswordSenderName );
3628 } else {
3629 $sender = new MailAddress( $from );
3632 $to = new MailAddress( $this );
3633 return UserMailer::send( $to, $sender, $subject, $body, $replyto );
3637 * Generate, store, and return a new e-mail confirmation code.
3638 * A hash (unsalted, since it's used as a key) is stored.
3640 * @note Call saveSettings() after calling this function to commit
3641 * this change to the database.
3643 * @param &$expiration \mixed Accepts the expiration time
3644 * @return String New token
3646 private function confirmationToken( &$expiration ) {
3647 global $wgUserEmailConfirmationTokenExpiry;
3648 $now = time();
3649 $expires = $now + $wgUserEmailConfirmationTokenExpiry;
3650 $expiration = wfTimestamp( TS_MW, $expires );
3651 $this->load();
3652 $token = MWCryptRand::generateHex( 32 );
3653 $hash = md5( $token );
3654 $this->mEmailToken = $hash;
3655 $this->mEmailTokenExpires = $expiration;
3656 return $token;
3660 * Return a URL the user can use to confirm their email address.
3661 * @param string $token Accepts the email confirmation token
3662 * @return String New token URL
3664 private function confirmationTokenUrl( $token ) {
3665 return $this->getTokenUrl( 'ConfirmEmail', $token );
3669 * Return a URL the user can use to invalidate their email address.
3670 * @param string $token Accepts the email confirmation token
3671 * @return String New token URL
3673 private function invalidationTokenUrl( $token ) {
3674 return $this->getTokenUrl( 'InvalidateEmail', $token );
3678 * Internal function to format the e-mail validation/invalidation URLs.
3679 * This uses a quickie hack to use the
3680 * hardcoded English names of the Special: pages, for ASCII safety.
3682 * @note Since these URLs get dropped directly into emails, using the
3683 * short English names avoids insanely long URL-encoded links, which
3684 * also sometimes can get corrupted in some browsers/mailers
3685 * (bug 6957 with Gmail and Internet Explorer).
3687 * @param string $page Special page
3688 * @param string $token Token
3689 * @return String Formatted URL
3691 protected function getTokenUrl( $page, $token ) {
3692 // Hack to bypass localization of 'Special:'
3693 $title = Title::makeTitle( NS_MAIN, "Special:$page/$token" );
3694 return $title->getCanonicalURL();
3698 * Mark the e-mail address confirmed.
3700 * @note Call saveSettings() after calling this function to commit the change.
3702 * @return bool
3704 public function confirmEmail() {
3705 // Check if it's already confirmed, so we don't touch the database
3706 // and fire the ConfirmEmailComplete hook on redundant confirmations.
3707 if ( !$this->isEmailConfirmed() ) {
3708 $this->setEmailAuthenticationTimestamp( wfTimestampNow() );
3709 wfRunHooks( 'ConfirmEmailComplete', array( $this ) );
3711 return true;
3715 * Invalidate the user's e-mail confirmation, and unauthenticate the e-mail
3716 * address if it was already confirmed.
3718 * @note Call saveSettings() after calling this function to commit the change.
3719 * @return bool Returns true
3721 function invalidateEmail() {
3722 $this->load();
3723 $this->mEmailToken = null;
3724 $this->mEmailTokenExpires = null;
3725 $this->setEmailAuthenticationTimestamp( null );
3726 wfRunHooks( 'InvalidateEmailComplete', array( $this ) );
3727 return true;
3731 * Set the e-mail authentication timestamp.
3732 * @param string $timestamp TS_MW timestamp
3734 function setEmailAuthenticationTimestamp( $timestamp ) {
3735 $this->load();
3736 $this->mEmailAuthenticated = $timestamp;
3737 wfRunHooks( 'UserSetEmailAuthenticationTimestamp', array( $this, &$this->mEmailAuthenticated ) );
3741 * Is this user allowed to send e-mails within limits of current
3742 * site configuration?
3743 * @return Bool
3745 public function canSendEmail() {
3746 global $wgEnableEmail, $wgEnableUserEmail;
3747 if ( !$wgEnableEmail || !$wgEnableUserEmail || !$this->isAllowed( 'sendemail' ) ) {
3748 return false;
3750 $canSend = $this->isEmailConfirmed();
3751 wfRunHooks( 'UserCanSendEmail', array( &$this, &$canSend ) );
3752 return $canSend;
3756 * Is this user allowed to receive e-mails within limits of current
3757 * site configuration?
3758 * @return Bool
3760 public function canReceiveEmail() {
3761 return $this->isEmailConfirmed() && !$this->getOption( 'disablemail' );
3765 * Is this user's e-mail address valid-looking and confirmed within
3766 * limits of the current site configuration?
3768 * @note If $wgEmailAuthentication is on, this may require the user to have
3769 * confirmed their address by returning a code or using a password
3770 * sent to the address from the wiki.
3772 * @return Bool
3774 public function isEmailConfirmed() {
3775 global $wgEmailAuthentication;
3776 $this->load();
3777 $confirmed = true;
3778 if ( wfRunHooks( 'EmailConfirmed', array( &$this, &$confirmed ) ) ) {
3779 if ( $this->isAnon() ) {
3780 return false;
3782 if ( !Sanitizer::validateEmail( $this->mEmail ) ) {
3783 return false;
3785 if ( $wgEmailAuthentication && !$this->getEmailAuthenticationTimestamp() ) {
3786 return false;
3788 return true;
3789 } else {
3790 return $confirmed;
3795 * Check whether there is an outstanding request for e-mail confirmation.
3796 * @return Bool
3798 public function isEmailConfirmationPending() {
3799 global $wgEmailAuthentication;
3800 return $wgEmailAuthentication &&
3801 !$this->isEmailConfirmed() &&
3802 $this->mEmailToken &&
3803 $this->mEmailTokenExpires > wfTimestamp();
3807 * Get the timestamp of account creation.
3809 * @return String|Bool|Null Timestamp of account creation, false for
3810 * non-existent/anonymous user accounts, or null if existing account
3811 * but information is not in database.
3813 public function getRegistration() {
3814 if ( $this->isAnon() ) {
3815 return false;
3817 $this->load();
3818 return $this->mRegistration;
3822 * Get the timestamp of the first edit
3824 * @return String|Bool Timestamp of first edit, or false for
3825 * non-existent/anonymous user accounts.
3827 public function getFirstEditTimestamp() {
3828 if ( $this->getId() == 0 ) {
3829 return false; // anons
3831 $dbr = wfGetDB( DB_SLAVE );
3832 $time = $dbr->selectField( 'revision', 'rev_timestamp',
3833 array( 'rev_user' => $this->getId() ),
3834 __METHOD__,
3835 array( 'ORDER BY' => 'rev_timestamp ASC' )
3837 if ( !$time ) {
3838 return false; // no edits
3840 return wfTimestamp( TS_MW, $time );
3844 * Get the permissions associated with a given list of groups
3846 * @param array $groups of Strings List of internal group names
3847 * @return Array of Strings List of permission key names for given groups combined
3849 public static function getGroupPermissions( $groups ) {
3850 global $wgGroupPermissions, $wgRevokePermissions;
3851 $rights = array();
3852 // grant every granted permission first
3853 foreach ( $groups as $group ) {
3854 if ( isset( $wgGroupPermissions[$group] ) ) {
3855 $rights = array_merge( $rights,
3856 // array_filter removes empty items
3857 array_keys( array_filter( $wgGroupPermissions[$group] ) ) );
3860 // now revoke the revoked permissions
3861 foreach ( $groups as $group ) {
3862 if ( isset( $wgRevokePermissions[$group] ) ) {
3863 $rights = array_diff( $rights,
3864 array_keys( array_filter( $wgRevokePermissions[$group] ) ) );
3867 return array_unique( $rights );
3871 * Get all the groups who have a given permission
3873 * @param string $role Role to check
3874 * @return Array of Strings List of internal group names with the given permission
3876 public static function getGroupsWithPermission( $role ) {
3877 global $wgGroupPermissions;
3878 $allowedGroups = array();
3879 foreach ( array_keys( $wgGroupPermissions ) as $group ) {
3880 if ( self::groupHasPermission( $group, $role ) ) {
3881 $allowedGroups[] = $group;
3884 return $allowedGroups;
3888 * Check, if the given group has the given permission
3890 * @since 1.21
3891 * @param string $group Group to check
3892 * @param string $role Role to check
3893 * @return bool
3895 public static function groupHasPermission( $group, $role ) {
3896 global $wgGroupPermissions, $wgRevokePermissions;
3897 return isset( $wgGroupPermissions[$group][$role] ) && $wgGroupPermissions[$group][$role]
3898 && !( isset( $wgRevokePermissions[$group][$role] ) && $wgRevokePermissions[$group][$role] );
3902 * Get the localized descriptive name for a group, if it exists
3904 * @param string $group Internal group name
3905 * @return String Localized descriptive group name
3907 public static function getGroupName( $group ) {
3908 $msg = wfMessage( "group-$group" );
3909 return $msg->isBlank() ? $group : $msg->text();
3913 * Get the localized descriptive name for a member of a group, if it exists
3915 * @param string $group Internal group name
3916 * @param string $username Username for gender (since 1.19)
3917 * @return String Localized name for group member
3919 public static function getGroupMember( $group, $username = '#' ) {
3920 $msg = wfMessage( "group-$group-member", $username );
3921 return $msg->isBlank() ? $group : $msg->text();
3925 * Return the set of defined explicit groups.
3926 * The implicit groups (by default *, 'user' and 'autoconfirmed')
3927 * are not included, as they are defined automatically, not in the database.
3928 * @return Array of internal group names
3930 public static function getAllGroups() {
3931 global $wgGroupPermissions, $wgRevokePermissions;
3932 return array_diff(
3933 array_merge( array_keys( $wgGroupPermissions ), array_keys( $wgRevokePermissions ) ),
3934 self::getImplicitGroups()
3939 * Get a list of all available permissions.
3940 * @return Array of permission names
3942 public static function getAllRights() {
3943 if ( self::$mAllRights === false ) {
3944 global $wgAvailableRights;
3945 if ( count( $wgAvailableRights ) ) {
3946 self::$mAllRights = array_unique( array_merge( self::$mCoreRights, $wgAvailableRights ) );
3947 } else {
3948 self::$mAllRights = self::$mCoreRights;
3950 wfRunHooks( 'UserGetAllRights', array( &self::$mAllRights ) );
3952 return self::$mAllRights;
3956 * Get a list of implicit groups
3957 * @return Array of Strings Array of internal group names
3959 public static function getImplicitGroups() {
3960 global $wgImplicitGroups;
3961 $groups = $wgImplicitGroups;
3962 wfRunHooks( 'UserGetImplicitGroups', array( &$groups ) ); #deprecated, use $wgImplictGroups instead
3963 return $groups;
3967 * Get the title of a page describing a particular group
3969 * @param string $group Internal group name
3970 * @return Title|Bool Title of the page if it exists, false otherwise
3972 public static function getGroupPage( $group ) {
3973 $msg = wfMessage( 'grouppage-' . $group )->inContentLanguage();
3974 if ( $msg->exists() ) {
3975 $title = Title::newFromText( $msg->text() );
3976 if ( is_object( $title ) ) {
3977 return $title;
3980 return false;
3984 * Create a link to the group in HTML, if available;
3985 * else return the group name.
3987 * @param string $group Internal name of the group
3988 * @param string $text The text of the link
3989 * @return String HTML link to the group
3991 public static function makeGroupLinkHTML( $group, $text = '' ) {
3992 if ( $text == '' ) {
3993 $text = self::getGroupName( $group );
3995 $title = self::getGroupPage( $group );
3996 if ( $title ) {
3997 return Linker::link( $title, htmlspecialchars( $text ) );
3998 } else {
3999 return $text;
4004 * Create a link to the group in Wikitext, if available;
4005 * else return the group name.
4007 * @param string $group Internal name of the group
4008 * @param string $text The text of the link
4009 * @return String Wikilink to the group
4011 public static function makeGroupLinkWiki( $group, $text = '' ) {
4012 if ( $text == '' ) {
4013 $text = self::getGroupName( $group );
4015 $title = self::getGroupPage( $group );
4016 if ( $title ) {
4017 $page = $title->getPrefixedText();
4018 return "[[$page|$text]]";
4019 } else {
4020 return $text;
4025 * Returns an array of the groups that a particular group can add/remove.
4027 * @param string $group the group to check for whether it can add/remove
4028 * @return Array array( 'add' => array( addablegroups ),
4029 * 'remove' => array( removablegroups ),
4030 * 'add-self' => array( addablegroups to self),
4031 * 'remove-self' => array( removable groups from self) )
4033 public static function changeableByGroup( $group ) {
4034 global $wgAddGroups, $wgRemoveGroups, $wgGroupsAddToSelf, $wgGroupsRemoveFromSelf;
4036 $groups = array( 'add' => array(), 'remove' => array(), 'add-self' => array(), 'remove-self' => array() );
4037 if ( empty( $wgAddGroups[$group] ) ) {
4038 // Don't add anything to $groups
4039 } elseif ( $wgAddGroups[$group] === true ) {
4040 // You get everything
4041 $groups['add'] = self::getAllGroups();
4042 } elseif ( is_array( $wgAddGroups[$group] ) ) {
4043 $groups['add'] = $wgAddGroups[$group];
4046 // Same thing for remove
4047 if ( empty( $wgRemoveGroups[$group] ) ) {
4048 } elseif ( $wgRemoveGroups[$group] === true ) {
4049 $groups['remove'] = self::getAllGroups();
4050 } elseif ( is_array( $wgRemoveGroups[$group] ) ) {
4051 $groups['remove'] = $wgRemoveGroups[$group];
4054 // Re-map numeric keys of AddToSelf/RemoveFromSelf to the 'user' key for backwards compatibility
4055 if ( empty( $wgGroupsAddToSelf['user'] ) || $wgGroupsAddToSelf['user'] !== true ) {
4056 foreach ( $wgGroupsAddToSelf as $key => $value ) {
4057 if ( is_int( $key ) ) {
4058 $wgGroupsAddToSelf['user'][] = $value;
4063 if ( empty( $wgGroupsRemoveFromSelf['user'] ) || $wgGroupsRemoveFromSelf['user'] !== true ) {
4064 foreach ( $wgGroupsRemoveFromSelf as $key => $value ) {
4065 if ( is_int( $key ) ) {
4066 $wgGroupsRemoveFromSelf['user'][] = $value;
4071 // Now figure out what groups the user can add to him/herself
4072 if ( empty( $wgGroupsAddToSelf[$group] ) ) {
4073 } elseif ( $wgGroupsAddToSelf[$group] === true ) {
4074 // No idea WHY this would be used, but it's there
4075 $groups['add-self'] = User::getAllGroups();
4076 } elseif ( is_array( $wgGroupsAddToSelf[$group] ) ) {
4077 $groups['add-self'] = $wgGroupsAddToSelf[$group];
4080 if ( empty( $wgGroupsRemoveFromSelf[$group] ) ) {
4081 } elseif ( $wgGroupsRemoveFromSelf[$group] === true ) {
4082 $groups['remove-self'] = User::getAllGroups();
4083 } elseif ( is_array( $wgGroupsRemoveFromSelf[$group] ) ) {
4084 $groups['remove-self'] = $wgGroupsRemoveFromSelf[$group];
4087 return $groups;
4091 * Returns an array of groups that this user can add and remove
4092 * @return Array array( 'add' => array( addablegroups ),
4093 * 'remove' => array( removablegroups ),
4094 * 'add-self' => array( addablegroups to self),
4095 * 'remove-self' => array( removable groups from self) )
4097 public function changeableGroups() {
4098 if ( $this->isAllowed( 'userrights' ) ) {
4099 // This group gives the right to modify everything (reverse-
4100 // compatibility with old "userrights lets you change
4101 // everything")
4102 // Using array_merge to make the groups reindexed
4103 $all = array_merge( User::getAllGroups() );
4104 return array(
4105 'add' => $all,
4106 'remove' => $all,
4107 'add-self' => array(),
4108 'remove-self' => array()
4112 // Okay, it's not so simple, we will have to go through the arrays
4113 $groups = array(
4114 'add' => array(),
4115 'remove' => array(),
4116 'add-self' => array(),
4117 'remove-self' => array()
4119 $addergroups = $this->getEffectiveGroups();
4121 foreach ( $addergroups as $addergroup ) {
4122 $groups = array_merge_recursive(
4123 $groups, $this->changeableByGroup( $addergroup )
4125 $groups['add'] = array_unique( $groups['add'] );
4126 $groups['remove'] = array_unique( $groups['remove'] );
4127 $groups['add-self'] = array_unique( $groups['add-self'] );
4128 $groups['remove-self'] = array_unique( $groups['remove-self'] );
4130 return $groups;
4134 * Increment the user's edit-count field.
4135 * Will have no effect for anonymous users.
4137 public function incEditCount() {
4138 if ( !$this->isAnon() ) {
4139 $dbw = wfGetDB( DB_MASTER );
4140 $dbw->update(
4141 'user',
4142 array( 'user_editcount=user_editcount+1' ),
4143 array( 'user_id' => $this->getId() ),
4144 __METHOD__
4147 // Lazy initialization check...
4148 if ( $dbw->affectedRows() == 0 ) {
4149 // Now here's a goddamn hack...
4150 $dbr = wfGetDB( DB_SLAVE );
4151 if ( $dbr !== $dbw ) {
4152 // If we actually have a slave server, the count is
4153 // at least one behind because the current transaction
4154 // has not been committed and replicated.
4155 $this->initEditCount( 1 );
4156 } else {
4157 // But if DB_SLAVE is selecting the master, then the
4158 // count we just read includes the revision that was
4159 // just added in the working transaction.
4160 $this->initEditCount();
4164 // edit count in user cache too
4165 $this->invalidateCache();
4169 * Initialize user_editcount from data out of the revision table
4171 * @param $add Integer Edits to add to the count from the revision table
4172 * @return Integer Number of edits
4174 protected function initEditCount( $add = 0 ) {
4175 // Pull from a slave to be less cruel to servers
4176 // Accuracy isn't the point anyway here
4177 $dbr = wfGetDB( DB_SLAVE );
4178 $count = (int) $dbr->selectField(
4179 'revision',
4180 'COUNT(rev_user)',
4181 array( 'rev_user' => $this->getId() ),
4182 __METHOD__
4184 $count = $count + $add;
4186 $dbw = wfGetDB( DB_MASTER );
4187 $dbw->update(
4188 'user',
4189 array( 'user_editcount' => $count ),
4190 array( 'user_id' => $this->getId() ),
4191 __METHOD__
4194 return $count;
4198 * Get the description of a given right
4200 * @param string $right Right to query
4201 * @return String Localized description of the right
4203 public static function getRightDescription( $right ) {
4204 $key = "right-$right";
4205 $msg = wfMessage( $key );
4206 return $msg->isBlank() ? $right : $msg->text();
4210 * Make an old-style password hash
4212 * @param string $password Plain-text password
4213 * @param string $userId User ID
4214 * @return String Password hash
4216 public static function oldCrypt( $password, $userId ) {
4217 global $wgPasswordSalt;
4218 if ( $wgPasswordSalt ) {
4219 return md5( $userId . '-' . md5( $password ) );
4220 } else {
4221 return md5( $password );
4226 * Make a new-style password hash
4228 * @param string $password Plain-text password
4229 * @param bool|string $salt Optional salt, may be random or the user ID.
4231 * If unspecified or false, will generate one automatically
4232 * @return String Password hash
4234 public static function crypt( $password, $salt = false ) {
4235 global $wgPasswordSalt;
4237 $hash = '';
4238 if ( !wfRunHooks( 'UserCryptPassword', array( &$password, &$salt, &$wgPasswordSalt, &$hash ) ) ) {
4239 return $hash;
4242 if ( $wgPasswordSalt ) {
4243 if ( $salt === false ) {
4244 $salt = MWCryptRand::generateHex( 8 );
4246 return ':B:' . $salt . ':' . md5( $salt . '-' . md5( $password ) );
4247 } else {
4248 return ':A:' . md5( $password );
4253 * Compare a password hash with a plain-text password. Requires the user
4254 * ID if there's a chance that the hash is an old-style hash.
4256 * @param string $hash Password hash
4257 * @param string $password Plain-text password to compare
4258 * @param string|bool $userId User ID for old-style password salt
4260 * @return Boolean
4262 public static function comparePasswords( $hash, $password, $userId = false ) {
4263 $type = substr( $hash, 0, 3 );
4265 $result = false;
4266 if ( !wfRunHooks( 'UserComparePasswords', array( &$hash, &$password, &$userId, &$result ) ) ) {
4267 return $result;
4270 if ( $type == ':A:' ) {
4271 # Unsalted
4272 return md5( $password ) === substr( $hash, 3 );
4273 } elseif ( $type == ':B:' ) {
4274 # Salted
4275 list( $salt, $realHash ) = explode( ':', substr( $hash, 3 ), 2 );
4276 return md5( $salt . '-' . md5( $password ) ) === $realHash;
4277 } else {
4278 # Old-style
4279 return self::oldCrypt( $password, $userId ) === $hash;
4284 * Add a newuser log entry for this user.
4285 * Before 1.19 the return value was always true.
4287 * @param string|bool $action account creation type.
4288 * - String, one of the following values:
4289 * - 'create' for an anonymous user creating an account for himself.
4290 * This will force the action's performer to be the created user itself,
4291 * no matter the value of $wgUser
4292 * - 'create2' for a logged in user creating an account for someone else
4293 * - 'byemail' when the created user will receive its password by e-mail
4294 * - Boolean means whether the account was created by e-mail (deprecated):
4295 * - true will be converted to 'byemail'
4296 * - false will be converted to 'create' if this object is the same as
4297 * $wgUser and to 'create2' otherwise
4299 * @param string $reason user supplied reason
4301 * @return int|bool True if not $wgNewUserLog; otherwise ID of log item or 0 on failure
4303 public function addNewUserLogEntry( $action = false, $reason = '' ) {
4304 global $wgUser, $wgNewUserLog;
4305 if ( empty( $wgNewUserLog ) ) {
4306 return true; // disabled
4309 if ( $action === true ) {
4310 $action = 'byemail';
4311 } elseif ( $action === false ) {
4312 if ( $this->getName() == $wgUser->getName() ) {
4313 $action = 'create';
4314 } else {
4315 $action = 'create2';
4319 if ( $action === 'create' || $action === 'autocreate' ) {
4320 $performer = $this;
4321 } else {
4322 $performer = $wgUser;
4325 $logEntry = new ManualLogEntry( 'newusers', $action );
4326 $logEntry->setPerformer( $performer );
4327 $logEntry->setTarget( $this->getUserPage() );
4328 $logEntry->setComment( $reason );
4329 $logEntry->setParameters( array(
4330 '4::userid' => $this->getId(),
4331 ) );
4332 $logid = $logEntry->insert();
4334 if ( $action !== 'autocreate' ) {
4335 $logEntry->publish( $logid );
4338 return (int)$logid;
4342 * Add an autocreate newuser log entry for this user
4343 * Used by things like CentralAuth and perhaps other authplugins.
4344 * Consider calling addNewUserLogEntry() directly instead.
4346 * @return bool
4348 public function addNewUserLogEntryAutoCreate() {
4349 $this->addNewUserLogEntry( 'autocreate' );
4351 return true;
4355 * Load the user options either from cache, the database or an array
4357 * @param array $data Rows for the current user out of the user_properties table
4359 protected function loadOptions( $data = null ) {
4360 global $wgContLang;
4362 $this->load();
4364 if ( $this->mOptionsLoaded ) {
4365 return;
4368 $this->mOptions = self::getDefaultOptions();
4370 if ( !$this->getId() ) {
4371 // For unlogged-in users, load language/variant options from request.
4372 // There's no need to do it for logged-in users: they can set preferences,
4373 // and handling of page content is done by $pageLang->getPreferredVariant() and such,
4374 // so don't override user's choice (especially when the user chooses site default).
4375 $variant = $wgContLang->getDefaultVariant();
4376 $this->mOptions['variant'] = $variant;
4377 $this->mOptions['language'] = $variant;
4378 $this->mOptionsLoaded = true;
4379 return;
4382 // Maybe load from the object
4383 if ( !is_null( $this->mOptionOverrides ) ) {
4384 wfDebug( "User: loading options for user " . $this->getId() . " from override cache.\n" );
4385 foreach ( $this->mOptionOverrides as $key => $value ) {
4386 $this->mOptions[$key] = $value;
4388 } else {
4389 if ( !is_array( $data ) ) {
4390 wfDebug( "User: loading options for user " . $this->getId() . " from database.\n" );
4391 // Load from database
4392 $dbr = wfGetDB( DB_SLAVE );
4394 $res = $dbr->select(
4395 'user_properties',
4396 array( 'up_property', 'up_value' ),
4397 array( 'up_user' => $this->getId() ),
4398 __METHOD__
4401 $this->mOptionOverrides = array();
4402 $data = array();
4403 foreach ( $res as $row ) {
4404 $data[$row->up_property] = $row->up_value;
4407 foreach ( $data as $property => $value ) {
4408 $this->mOptionOverrides[$property] = $value;
4409 $this->mOptions[$property] = $value;
4413 $this->mOptionsLoaded = true;
4415 wfRunHooks( 'UserLoadOptions', array( $this, &$this->mOptions ) );
4419 * @todo document
4421 protected function saveOptions() {
4422 $this->loadOptions();
4424 // Not using getOptions(), to keep hidden preferences in database
4425 $saveOptions = $this->mOptions;
4427 // Allow hooks to abort, for instance to save to a global profile.
4428 // Reset options to default state before saving.
4429 if ( !wfRunHooks( 'UserSaveOptions', array( $this, &$saveOptions ) ) ) {
4430 return;
4433 $userId = $this->getId();
4434 $insert_rows = array();
4435 foreach ( $saveOptions as $key => $value ) {
4436 # Don't bother storing default values
4437 $defaultOption = self::getDefaultOption( $key );
4438 if ( ( is_null( $defaultOption ) &&
4439 !( $value === false || is_null( $value ) ) ) ||
4440 $value != $defaultOption ) {
4441 $insert_rows[] = array(
4442 'up_user' => $userId,
4443 'up_property' => $key,
4444 'up_value' => $value,
4449 $dbw = wfGetDB( DB_MASTER );
4450 $hasRows = $dbw->selectField( 'user_properties', '1',
4451 array( 'up_user' => $userId ), __METHOD__ );
4453 if ( $hasRows ) {
4454 // Only do this delete if there is something there. A very large portion of
4455 // calls to this function are for setting 'rememberpassword' for new accounts.
4456 // Doing this delete for new accounts with no rows in the table rougly causes
4457 // gap locks on [max user ID,+infinity) which causes high contention since many
4458 // updates will pile up on each other since they are for higher (newer) user IDs.
4459 $dbw->delete( 'user_properties', array( 'up_user' => $userId ), __METHOD__ );
4461 $dbw->insert( 'user_properties', $insert_rows, __METHOD__, array( 'IGNORE' ) );
4465 * Provide an array of HTML5 attributes to put on an input element
4466 * intended for the user to enter a new password. This may include
4467 * required, title, and/or pattern, depending on $wgMinimalPasswordLength.
4469 * Do *not* use this when asking the user to enter his current password!
4470 * Regardless of configuration, users may have invalid passwords for whatever
4471 * reason (e.g., they were set before requirements were tightened up).
4472 * Only use it when asking for a new password, like on account creation or
4473 * ResetPass.
4475 * Obviously, you still need to do server-side checking.
4477 * NOTE: A combination of bugs in various browsers means that this function
4478 * actually just returns array() unconditionally at the moment. May as
4479 * well keep it around for when the browser bugs get fixed, though.
4481 * @todo FIXME: This does not belong here; put it in Html or Linker or somewhere
4483 * @return array Array of HTML attributes suitable for feeding to
4484 * Html::element(), directly or indirectly. (Don't feed to Xml::*()!
4485 * That will potentially output invalid XHTML 1.0 Transitional, and will
4486 * get confused by the boolean attribute syntax used.)
4488 public static function passwordChangeInputAttribs() {
4489 global $wgMinimalPasswordLength;
4491 if ( $wgMinimalPasswordLength == 0 ) {
4492 return array();
4495 # Note that the pattern requirement will always be satisfied if the
4496 # input is empty, so we need required in all cases.
4498 # @todo FIXME: Bug 23769: This needs to not claim the password is required
4499 # if e-mail confirmation is being used. Since HTML5 input validation
4500 # is b0rked anyway in some browsers, just return nothing. When it's
4501 # re-enabled, fix this code to not output required for e-mail
4502 # registration.
4503 #$ret = array( 'required' );
4504 $ret = array();
4506 # We can't actually do this right now, because Opera 9.6 will print out
4507 # the entered password visibly in its error message! When other
4508 # browsers add support for this attribute, or Opera fixes its support,
4509 # we can add support with a version check to avoid doing this on Opera
4510 # versions where it will be a problem. Reported to Opera as
4511 # DSK-262266, but they don't have a public bug tracker for us to follow.
4513 if ( $wgMinimalPasswordLength > 1 ) {
4514 $ret['pattern'] = '.{' . intval( $wgMinimalPasswordLength ) . ',}';
4515 $ret['title'] = wfMessage( 'passwordtooshort' )
4516 ->numParams( $wgMinimalPasswordLength )->text();
4520 return $ret;
4524 * Return the list of user fields that should be selected to create
4525 * a new user object.
4526 * @return array
4528 public static function selectFields() {
4529 return array(
4530 'user_id',
4531 'user_name',
4532 'user_real_name',
4533 'user_password',
4534 'user_newpassword',
4535 'user_newpass_time',
4536 'user_email',
4537 'user_touched',
4538 'user_token',
4539 'user_email_authenticated',
4540 'user_email_token',
4541 'user_email_token_expires',
4542 'user_registration',
4543 'user_editcount',