includes/User.php

   1 <?php
   2 /**
   3  * See user.txt
   4  *
   5  */
   6
   7 # Number of characters in user_token field
   8 define( 'USER_TOKEN_LENGTH', 32 );
   9
  10 # Serialized record version
  11 define( 'MW_USER_VERSION', 5 );
  12
  13 # Some punctuation to prevent editing from broken text-mangling proxies.
  14 define( 'EDIT_TOKEN_SUFFIX', '+\\' );
  15
  16 /**
  17  * Thrown by User::setPassword() on error
  18  * @addtogroup Exception
  19  */
  20 class PasswordError extends MWException {
  21         // NOP
  22 }
  23
  24 /**
  25  * The User object encapsulates all of the user-specific settings (user_id,
  26  * name, rights, password, email address, options, last login time). Client
  27  * classes use the getXXX() functions to access these fields. These functions
  28  * do all the work of determining whether the user is logged in,
  29  * whether the requested option can be satisfied from cookies or
  30  * whether a database query is needed. Most of the settings needed
  31  * for rendering normal pages are set in the cookie to minimize use
  32  * of the database.
  33  */
  34 class User {
  35
  36         /**
  37          * A list of default user toggles, i.e. boolean user preferences that are
  38          * displayed by Special:Preferences as checkboxes. This list can be
  39          * extended via the UserToggles hook or $wgContLang->getExtraUserToggles().
  40          */
  41         static public $mToggles = array(
  42                 'highlightbroken',
  43                 'justify',
  44                 'hideminor',
  45                 'extendwatchlist',
  46                 'usenewrc',
  47                 'numberheadings',
  48                 'showtoolbar',
  49                 'editondblclick',
  50                 'editsection',
  51                 'editsectiononrightclick',
  52                 'showtoc',
  53                 'rememberpassword',
  54                 'editwidth',
  55                 'watchcreations',
  56                 'watchdefault',
  57                 'watchmoves',
  58                 'watchdeletion',
  59                 'minordefault',
  60                 'previewontop',
  61                 'previewonfirst',
  62                 'nocache',
  63                 'enotifwatchlistpages',
  64                 'enotifusertalkpages',
  65                 'enotifminoredits',
  66                 'enotifrevealaddr',
  67                 'shownumberswatching',
  68                 'fancysig',
  69                 'externaleditor',
  70                 'externaldiff',
  71                 'showjumplinks',
  72                 'uselivepreview',
  73                 'forceeditsummary',
  74                 'watchlisthideown',
  75                 'watchlisthidebots',
  76                 'watchlisthideminor',
  77                 'ccmeonemails',
  78                 'diffonly',
  79         );
  80
  81         /**
  82          * List of member variables which are saved to the shared cache (memcached).
  83          * Any operation which changes the corresponding database fields must
  84          * call a cache-clearing function.
  85          */
  86         static $mCacheVars = array(
  87                 # user table
  88                 'mId',
  89                 'mName',
  90                 'mRealName',
  91                 'mPassword',
  92                 'mNewpassword',
  93                 'mNewpassTime',
  94                 'mEmail',
  95                 'mOptions',
  96                 'mTouched',
  97                 'mToken',
  98                 'mEmailAuthenticated',
  99                 'mEmailToken',
 100                 'mEmailTokenExpires',
 101                 'mRegistration',
 102                 'mEditCount',
 103                 # user_group table
 104                 'mGroups',
 105         );
 106
 107         /**
 108          * The cache variable declarations
 109          */
 110         var $mId, $mName, $mRealName, $mPassword, $mNewpassword, $mNewpassTime,
 111                 $mEmail, $mOptions, $mTouched, $mToken, $mEmailAuthenticated,
 112                 $mEmailToken, $mEmailTokenExpires, $mRegistration, $mGroups;
 113
 114         /**
 115          * Whether the cache variables have been loaded
 116          */
 117         var $mDataLoaded;
 118
 119         /**
 120          * Initialisation data source if mDataLoaded==false. May be one of:
 121          *    defaults      anonymous user initialised from class defaults
 122          *    name          initialise from mName
 123          *    id            initialise from mId
 124          *    session       log in from cookies or session if possible
 125          *
 126          * Use the User::newFrom*() family of functions to set this.
 127          */
 128         var $mFrom;
 129
 130         /**
 131          * Lazy-initialised variables, invalidated with clearInstanceCache
 132          */
 133         var $mNewtalk, $mDatePreference, $mBlockedby, $mHash, $mSkin, $mRights,
 134                 $mBlockreason, $mBlock, $mEffectiveGroups;
 135
 136         /**
 137          * Lightweight constructor for anonymous user
 138          * Use the User::newFrom* factory functions for other kinds of users
 139          */
 140         function User() {
 141                 $this->clearInstanceCache( 'defaults' );
 142         }
 143
 144         /**
 145          * Load the user table data for this object from the source given by mFrom
 146          */
 147         function load() {
 148                 if ( $this->mDataLoaded ) {
 149                         return;
 150                 }
 151                 wfProfileIn( __METHOD__ );
 152
 153                 # Set it now to avoid infinite recursion in accessors
 154                 $this->mDataLoaded = true;
 155
 156                 switch ( $this->mFrom ) {
 157                         case 'defaults':
 158                                 $this->loadDefaults();
 159                                 break;
 160                         case 'name':
 161                                 $this->mId = self::idFromName( $this->mName );
 162                                 if ( !$this->mId ) {
 163                                         # Nonexistent user placeholder object
 164                                         $this->loadDefaults( $this->mName );
 165                                 } else {
 166                                         $this->loadFromId();
 167                                 }
 168                                 break;
 169                         case 'id':
 170                                 $this->loadFromId();
 171                                 break;
 172                         case 'session':
 173                                 $this->loadFromSession();
 174                                 break;
 175                         default:
 176                                 throw new MWException( "Unrecognised value for User->mFrom: \"{$this->mFrom}\"" );
 177                 }
 178                 wfProfileOut( __METHOD__ );
 179         }
 180
 181         /**
 182          * Load user table data given mId
 183          * @return false if the ID does not exist, true otherwise
 184          * @private
 185          */
 186         function loadFromId() {
 187                 global $wgMemc;
 188                 if ( $this->mId == 0 ) {
 189                         $this->loadDefaults();
 190                         return false;
 191                 }
 192
 193                 # Try cache
 194                 $key = wfMemcKey( 'user', 'id', $this->mId );
 195                 $data = $wgMemc->get( $key );
 196                 if ( !is_array( $data ) || $data['mVersion'] < MW_USER_VERSION ) {
 197                         # Object is expired, load from DB
 198                         $data = false;
 199                 }
 200
 201                 if ( !$data ) {
 202                         wfDebug( "Cache miss for user {$this->mId}\n" );
 203                         # Load from DB
 204                         if ( !$this->loadFromDatabase() ) {
 205                                 # Can't load from ID, user is anonymous
 206                                 return false;
 207                         }
 208
 209                         # Save to cache
 210                         $data = array();
 211                         foreach ( self::$mCacheVars as $name ) {
 212                                 $data[$name] = $this->$name;
 213                         }
 214                         $data['mVersion'] = MW_USER_VERSION;
 215                         $wgMemc->set( $key, $data );
 216                 } else {
 217                         wfDebug( "Got user {$this->mId} from cache\n" );
 218                         # Restore from cache
 219                         foreach ( self::$mCacheVars as $name ) {
 220                                 $this->$name = $data[$name];
 221                         }
 222                 }
 223                 return true;
 224         }
 225
 226         /**
 227          * Static factory method for creation from username.
 228          *
 229          * This is slightly less efficient than newFromId(), so use newFromId() if
 230          * you have both an ID and a name handy.
 231          *
 232          * @param string $name Username, validated by Title:newFromText()
 233          * @param mixed $validate Validate username. Takes the same parameters as
 234          *    User::getCanonicalName(), except that true is accepted as an alias
 235          *    for 'valid', for BC.
 236          *
 237          * @return User object, or null if the username is invalid. If the username
 238          *    is not present in the database, the result will be a user object with
 239          *    a name, zero user ID and default settings.
 240          * @static
 241          */
 242         static function newFromName( $name, $validate = 'valid' ) {
 243                 if ( $validate === true ) {
 244                         $validate = 'valid';
 245                 }
 246                 $name = self::getCanonicalName( $name, $validate );
 247                 if ( $name === false ) {
 248                         return null;
 249                 } else {
 250                         # Create unloaded user object
 251                         $u = new User;
 252                         $u->mName = $name;
 253                         $u->mFrom = 'name';
 254                         return $u;
 255                 }
 256         }
 257
 258         static function newFromId( $id ) {
 259                 $u = new User;
 260                 $u->mId = $id;
 261                 $u->mFrom = 'id';
 262                 return $u;
 263         }
 264
 265         /**
 266          * Factory method to fetch whichever user has a given email confirmation code.
 267          * This code is generated when an account is created or its e-mail address
 268          * has changed.
 269          *
 270          * If the code is invalid or has expired, returns NULL.
 271          *
 272          * @param string $code
 273          * @return User
 274          * @static
 275          */
 276         static function newFromConfirmationCode( $code ) {
 277                 $dbr = wfGetDB( DB_SLAVE );
 278                 $id = $dbr->selectField( 'user', 'user_id', array(
 279                         'user_email_token' => md5( $code ),
 280                         'user_email_token_expires > ' . $dbr->addQuotes( $dbr->timestamp() ),
 281                         ) );
 282                 if( $id !== false ) {
 283                         return User::newFromId( $id );
 284                 } else {
 285                         return null;
 286                 }
 287         }
 288
 289         /**
 290          * Create a new user object using data from session or cookies. If the
 291          * login credentials are invalid, the result is an anonymous user.
 292          *
 293          * @return User
 294          * @static
 295          */
 296         static function newFromSession() {
 297                 $user = new User;
 298                 $user->mFrom = 'session';
 299                 return $user;
 300         }
 301
 302         /**
 303          * Get username given an id.
 304          * @param integer $id Database user id
 305          * @return string Nickname of a user
 306          * @static
 307          */
 308         static function whoIs( $id ) {
 309                 $dbr = wfGetDB( DB_SLAVE );
 310                 return $dbr->selectField( 'user', 'user_name', array( 'user_id' => $id ), 'User::whoIs' );
 311         }
 312
 313         /**
 314          * Get real username given an id.
 315          * @param integer $id Database user id
 316          * @return string Realname of a user
 317          * @static
 318          */
 319         static function whoIsReal( $id ) {
 320                 $dbr = wfGetDB( DB_SLAVE );
 321                 return $dbr->selectField( 'user', 'user_real_name', array( 'user_id' => $id ), 'User::whoIsReal' );
 322         }
 323
 324         /**
 325          * Get database id given a user name
 326          * @param string $name Nickname of a user
 327          * @return integer|null Database user id (null: if non existent
 328          * @static
 329          */
 330         static function idFromName( $name ) {
 331                 $nt = Title::newFromText( $name );
 332                 if( is_null( $nt ) ) {
 333                         # Illegal name
 334                         return null;
 335                 }
 336                 $dbr = wfGetDB( DB_SLAVE );
 337                 $s = $dbr->selectRow( 'user', array( 'user_id' ), array( 'user_name' => $nt->getText() ), __METHOD__ );
 338
 339                 if ( $s === false ) {
 340                         return 0;
 341                 } else {
 342                         return $s->user_id;
 343                 }
 344         }
 345
 346         /**
 347          * Does the string match an anonymous IPv4 address?
 348          *
 349          * This function exists for username validation, in order to reject
 350          * usernames which are similar in form to IP addresses. Strings such
 351          * as 300.300.300.300 will return true because it looks like an IP
 352          * address, despite not being strictly valid.
 353          *
 354          * We match \d{1,3}\.\d{1,3}\.\d{1,3}\.xxx as an anonymous IP
 355          * address because the usemod software would "cloak" anonymous IP
 356          * addresses like this, if we allowed accounts like this to be created
 357          * new users could get the old edits of these anonymous users.
 358          *
 359          * @static
 360          * @param string $name Nickname of a user
 361          * @return bool
 362          */
 363         static function isIP( $name ) {
 364                 return preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.(?:xxx|\d{1,3})$/',$name) || User::isIPv6($name);
 365                 /*return preg_match("/^
 366                         (?:[01]?\d{1,2}|2(:?[0-4]\d|5[0-5]))\.
 367                         (?:[01]?\d{1,2}|2(:?[0-4]\d|5[0-5]))\.
 368                         (?:[01]?\d{1,2}|2(:?[0-4]\d|5[0-5]))\.
 369                         (?:[01]?\d{1,2}|2(:?[0-4]\d|5[0-5]))
 370                 $/x", $name);*/
 371         }
 372
 373         /**
 374          * Check if $name is an IPv6 IP.
 375          */
 376         static function isIPv6($name) {
 377                 /*
 378                  * if it has any non-valid characters, it can't be a valid IPv6
 379                  * address.
 380                  */
 381                 if (preg_match("/[^:a-fA-F0-9]/", $name))
 382                         return false;
 383
 384                 $parts = explode(":", $name);
 385                 if (count($parts) < 3)
 386                         return false;
 387                 foreach ($parts as $part) {
 388                         if (!preg_match("/^[0-9a-fA-F]{0,4}$/", $part))
 389                                 return false;
 390                 }
 391                 return true;
 392         }
 393
 394         /**
 395          * Is the input a valid username?
 396          *
 397          * Checks if the input is a valid username, we don't want an empty string,
 398          * an IP address, anything that containins slashes (would mess up subpages),
 399          * is longer than the maximum allowed username size or doesn't begin with
 400          * a capital letter.
 401          *
 402          * @param string $name
 403          * @return bool
 404          * @static
 405          */
 406         static function isValidUserName( $name ) {
 407                 global $wgContLang, $wgMaxNameChars;
 408
 409                 if ( $name == ''
 410                 || User::isIP( $name )
 411                 || strpos( $name, '/' ) !== false
 412                 || strlen( $name ) > $wgMaxNameChars
 413                 || $name != $wgContLang->ucfirst( $name ) )
 414                         return false;
 415
 416                 // Ensure that the name can't be misresolved as a different title,
 417                 // such as with extra namespace keys at the start.
 418                 $parsed = Title::newFromText( $name );
 419                 if( is_null( $parsed )
 420                         || $parsed->getNamespace()
 421                         || strcmp( $name, $parsed->getPrefixedText() ) )
 422                         return false;
 423
 424                 // Check an additional blacklist of troublemaker characters.
 425                 // Should these be merged into the title char list?
 426                 $unicodeBlacklist = '/[' .
 427                         '\x{0080}-\x{009f}' . # iso-8859-1 control chars
 428                         '\x{00a0}' .          # non-breaking space
 429                         '\x{2000}-\x{200f}' . # various whitespace
 430                         '\x{2028}-\x{202f}' . # breaks and control chars
 431                         '\x{3000}' .          # ideographic space
 432                         '\x{e000}-\x{f8ff}' . # private use
 433                         ']/u';
 434                 if( preg_match( $unicodeBlacklist, $name ) ) {
 435                         return false;
 436                 }
 437
 438                 return true;
 439         }
 440
 441         /**
 442          * Usernames which fail to pass this function will be blocked
 443          * from user login and new account registrations, but may be used
 444          * internally by batch processes.
 445          *
 446          * If an account already exists in this form, login will be blocked
 447          * by a failure to pass this function.
 448          *
 449          * @param string $name
 450          * @return bool
 451          */
 452         static function isUsableName( $name ) {
 453                 global $wgReservedUsernames;
 454                 return
 455                         // Must be a usable username, obviously ;)
 456                         self::isValidUserName( $name ) &&
 457
 458                         // Certain names may be reserved for batch processes.
 459                         !in_array( $name, $wgReservedUsernames );
 460         }
 461
 462         /**
 463          * Usernames which fail to pass this function will be blocked
 464          * from new account registrations, but may be used internally
 465          * either by batch processes or by user accounts which have
 466          * already been created.
 467          *
 468          * Additional character blacklisting may be added here
 469          * rather than in isValidUserName() to avoid disrupting
 470          * existing accounts.
 471          *
 472          * @param string $name
 473          * @return bool
 474          */
 475         static function isCreatableName( $name ) {
 476                 return
 477                         self::isUsableName( $name ) &&
 478
 479                         // Registration-time character blacklisting...
 480                         strpos( $name, '@' ) === false;
 481         }
 482
 483         /**
 484          * Is the input a valid password for this user?
 485          *
 486          * @param string $password Desired password
 487          * @return bool
 488          */
 489         function isValidPassword( $password ) {
 490                 global $wgMinimalPasswordLength, $wgContLang;
 491
 492                 $result = null;
 493                 if( !wfRunHooks( 'isValidPassword', array( $password, &$result, $this ) ) )
 494                         return $result;
 495                 if( $result === false )
 496                         return false;
 497
 498                 // Password needs to be long enough, and can't be the same as the username
 499                 return strlen( $password ) >= $wgMinimalPasswordLength
 500                         && $wgContLang->lc( $password ) !== $wgContLang->lc( $this->mName );
 501         }
 502
 503         /**
 504          * Does a string look like an email address?
 505          *
 506          * There used to be a regular expression here, it got removed because it
 507          * rejected valid addresses. Actually just check if there is '@' somewhere
 508          * in the given address.
 509          *
 510          * @todo Check for RFC 2822 compilance (bug 959)
 511          *
 512          * @param string $addr email address
 513          * @return bool
 514          */
 515         public static function isValidEmailAddr( $addr ) {
 516                 return strpos( $addr, '@' ) !== false;
 517         }
 518
 519         /**
 520          * Given unvalidated user input, return a canonical username, or false if
 521          * the username is invalid.
 522          * @param string $name
 523          * @param mixed $validate Type of validation to use:
 524          *                         false        No validation
 525          *                         'valid'      Valid for batch processes
 526          *                         'usable'     Valid for batch processes and login
 527          *                         'creatable'  Valid for batch processes, login and account creation
 528          */
 529         static function getCanonicalName( $name, $validate = 'valid' ) {
 530                 # Force usernames to capital
 531                 global $wgContLang;
 532                 $name = $wgContLang->ucfirst( $name );
 533
 534                 # Reject names containing '#'; these will be cleaned up
 535                 # with title normalisation, but then it's too late to
 536                 # check elsewhere
 537                 if( strpos( $name, '#' ) !== false )
 538                         return false;
 539
 540                 # Clean up name according to title rules
 541                 $t = Title::newFromText( $name );
 542                 if( is_null( $t ) ) {
 543                         return false;
 544                 }
 545
 546                 # Reject various classes of invalid names
 547                 $name = $t->getText();
 548                 global $wgAuth;
 549                 $name = $wgAuth->getCanonicalName( $t->getText() );
 550
 551                 switch ( $validate ) {
 552                         case false:
 553                                 break;
 554                         case 'valid':
 555                                 if ( !User::isValidUserName( $name ) ) {
 556                                         $name = false;
 557                                 }
 558                                 break;
 559                         case 'usable':
 560                                 if ( !User::isUsableName( $name ) ) {
 561                                         $name = false;
 562                                 }
 563                                 break;
 564                         case 'creatable':
 565                                 if ( !User::isCreatableName( $name ) ) {
 566                                         $name = false;
 567                                 }
 568                                 break;
 569                         default:
 570                                 throw new MWException( 'Invalid parameter value for $validate in '.__METHOD__ );
 571                 }
 572                 return $name;
 573         }
 574
 575         /**
 576          * Count the number of edits of a user
 577          *
 578          * It should not be static and some day should be merged as proper member function / deprecated -- domas
 579          *
 580          * @param int $uid The user ID to check
 581          * @return int
 582          * @static
 583          */
 584         static function edits( $uid ) {
 585                 wfProfileIn( __METHOD__ );
 586                 $dbr = wfGetDB( DB_SLAVE );
 587                 // check if the user_editcount field has been initialized
 588                 $field = $dbr->selectField(
 589                         'user', 'user_editcount',
 590                         array( 'user_id' => $uid ),
 591                         __METHOD__
 592                 );
 593
 594                 if( $field === null ) { // it has not been initialized. do so.
 595                         $dbw = wfGetDb( DB_MASTER );
 596                         $count = $dbr->selectField(
 597                                 'revision', 'count(*)',
 598                                 array( 'rev_user' => $uid ),
 599                                 __METHOD__
 600                         );
 601                         $dbw->update(
 602                                 'user',
 603                                 array( 'user_editcount' => $count ),
 604                                 array( 'user_id' => $uid ),
 605                                 __METHOD__
 606                         );
 607                 } else {
 608                         $count = $field;
 609                 }
 610                 wfProfileOut( __METHOD__ );
 611                 return $count;
 612         }
 613
 614         /**
 615          * Return a random password. Sourced from mt_rand, so it's not particularly secure.
 616          * @todo hash random numbers to improve security, like generateToken()
 617          *
 618          * @return string
 619          * @static
 620          */
 621         static function randomPassword() {
 622                 global $wgMinimalPasswordLength;
 623                 $pwchars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz';
 624                 $l = strlen( $pwchars ) - 1;
 625
 626                 $pwlength = max( 7, $wgMinimalPasswordLength );
 627                 $digit = mt_rand(0, $pwlength - 1);
 628                 $np = '';
 629                 for ( $i = 0; $i < $pwlength; $i++ ) {
 630                         $np .= $i == $digit ? chr( mt_rand(48, 57) ) : $pwchars{ mt_rand(0, $l)};
 631                 }
 632                 return $np;
 633         }
 634
 635         /**
 636          * Set cached properties to default. Note: this no longer clears
 637          * uncached lazy-initialised properties. The constructor does that instead.
 638          *
 639          * @private
 640          */
 641         function loadDefaults( $name = false ) {
 642                 wfProfileIn( __METHOD__ );
 643
 644                 global $wgCookiePrefix;
 645
 646                 $this->mId = 0;
 647                 $this->mName = $name;
 648                 $this->mRealName = '';
 649                 $this->mPassword = $this->mNewpassword = '';
 650                 $this->mNewpassTime = null;
 651                 $this->mEmail = '';
 652                 $this->mOptions = null; # Defer init
 653
 654                 if ( isset( $_COOKIE[$wgCookiePrefix.'LoggedOut'] ) ) {
 655                         $this->mTouched = wfTimestamp( TS_MW, $_COOKIE[$wgCookiePrefix.'LoggedOut'] );
 656                 } else {
 657                         $this->mTouched = '0'; # Allow any pages to be cached
 658                 }
 659
 660                 $this->setToken(); # Random
 661                 $this->mEmailAuthenticated = null;
 662                 $this->mEmailToken = '';
 663                 $this->mEmailTokenExpires = null;
 664                 $this->mRegistration = wfTimestamp( TS_MW );
 665                 $this->mGroups = array();
 666
 667                 wfProfileOut( __METHOD__ );
 668         }
 669
 670         /**
 671          * Initialise php session
 672          * @deprecated use wfSetupSession()
 673          */
 674         function SetupSession() {
 675                 wfSetupSession();
 676         }
 677
 678         /**
 679          * Load user data from the session or login cookie. If there are no valid
 680          * credentials, initialises the user as an anon.
 681          * @return true if the user is logged in, false otherwise
 682          */
 683         private function loadFromSession() {
 684                 global $wgMemc, $wgCookiePrefix;
 685
 686                 if ( isset( $_SESSION['wsUserID'] ) ) {
 687                         if ( 0 != $_SESSION['wsUserID'] ) {
 688                                 $sId = $_SESSION['wsUserID'];
 689                         } else {
 690                                 $this->loadDefaults();
 691                                 return false;
 692                         }
 693                 } else if ( isset( $_COOKIE["{$wgCookiePrefix}UserID"] ) ) {
 694                         $sId = intval( $_COOKIE["{$wgCookiePrefix}UserID"] );
 695                         $_SESSION['wsUserID'] = $sId;
 696                 } else {
 697                         $this->loadDefaults();
 698                         return false;
 699                 }
 700                 if ( isset( $_SESSION['wsUserName'] ) ) {
 701                         $sName = $_SESSION['wsUserName'];
 702                 } else if ( isset( $_COOKIE["{$wgCookiePrefix}UserName"] ) ) {
 703                         $sName = $_COOKIE["{$wgCookiePrefix}UserName"];
 704                         $_SESSION['wsUserName'] = $sName;
 705                 } else {
 706                         $this->loadDefaults();
 707                         return false;
 708                 }
 709
 710                 $passwordCorrect = FALSE;
 711                 $this->mId = $sId;
 712                 if ( !$this->loadFromId() ) {
 713                         # Not a valid ID, loadFromId has switched the object to anon for us
 714                         return false;
 715                 }
 716
 717                 if ( isset( $_SESSION['wsToken'] ) ) {
 718                         $passwordCorrect = $_SESSION['wsToken'] == $this->mToken;
 719                         $from = 'session';
 720                 } else if ( isset( $_COOKIE["{$wgCookiePrefix}Token"] ) ) {
 721                         $passwordCorrect = $this->mToken == $_COOKIE["{$wgCookiePrefix}Token"];
 722                         $from = 'cookie';
 723                 } else {
 724                         # No session or persistent login cookie
 725                         $this->loadDefaults();
 726                         return false;
 727                 }
 728
 729                 if ( ( $sName == $this->mName ) && $passwordCorrect ) {
 730                         $_SESSION['wsToken'] = $this->mToken;
 731                         wfDebug( "Logged in from $from\n" );
 732                         return true;
 733                 } else {
 734                         # Invalid credentials
 735                         wfDebug( "Can't log in from $from, invalid credentials\n" );
 736                         $this->loadDefaults();
 737                         return false;
 738                 }
 739         }
 740
 741         /**
 742          * Load user and user_group data from the database
 743          * $this->mId must be set, this is how the user is identified.
 744          *
 745          * @return true if the user exists, false if the user is anonymous
 746          * @private
 747          */
 748         function loadFromDatabase() {
 749                 # Paranoia
 750                 $this->mId = intval( $this->mId );
 751
 752                 /** Anonymous user */
 753                 if( !$this->mId ) {
 754                         $this->loadDefaults();
 755                         return false;
 756                 }
 757
 758                 $dbr = wfGetDB( DB_MASTER );
 759                 $s = $dbr->selectRow( 'user', '*', array( 'user_id' => $this->mId ), __METHOD__ );
 760
 761                 if ( $s !== false ) {
 762                         # Initialise user table data
 763                         $this->mName = $s->user_name;
 764                         $this->mRealName = $s->user_real_name;
 765                         $this->mPassword = $s->user_password;
 766                         $this->mNewpassword = $s->user_newpassword;
 767                         $this->mNewpassTime = wfTimestampOrNull( TS_MW, $s->user_newpass_time );
 768                         $this->mEmail = $s->user_email;
 769                         $this->decodeOptions( $s->user_options );
 770                         $this->mTouched = wfTimestamp(TS_MW,$s->user_touched);
 771                         $this->mToken = $s->user_token;
 772                         $this->mEmailAuthenticated = wfTimestampOrNull( TS_MW, $s->user_email_authenticated );
 773                         $this->mEmailToken = $s->user_email_token;
 774                         $this->mEmailTokenExpires = wfTimestampOrNull( TS_MW, $s->user_email_token_expires );
 775                         $this->mRegistration = wfTimestampOrNull( TS_MW, $s->user_registration );
 776                         $this->mEditCount = $s->user_editcount;
 777                         $this->getEditCount(); // revalidation for nulls
 778
 779                         # Load group data
 780                         $res = $dbr->select( 'user_groups',
 781                                 array( 'ug_group' ),
 782                                 array( 'ug_user' => $this->mId ),
 783                                 __METHOD__ );
 784                         $this->mGroups = array();
 785                         while( $row = $dbr->fetchObject( $res ) ) {
 786                                 $this->mGroups[] = $row->ug_group;
 787                         }
 788                         return true;
 789                 } else {
 790                         # Invalid user_id
 791                         $this->mId = 0;
 792                         $this->loadDefaults();
 793                         return false;
 794                 }
 795         }
 796
 797         /**
 798          * Clear various cached data stored in this object.
 799          * @param string $reloadFrom Reload user and user_groups table data from a
 800          *   given source. May be "name", "id", "defaults", "session" or false for
 801          *   no reload.
 802          */
 803         function clearInstanceCache( $reloadFrom = false ) {
 804                 $this->mNewtalk = -1;
 805                 $this->mDatePreference = null;
 806                 $this->mBlockedby = -1; # Unset
 807                 $this->mHash = false;
 808                 $this->mSkin = null;
 809                 $this->mRights = null;
 810                 $this->mEffectiveGroups = null;
 811
 812                 if ( $reloadFrom ) {
 813                         $this->mDataLoaded = false;
 814                         $this->mFrom = $reloadFrom;
 815                 }
 816         }
 817
 818         /**
 819          * Combine the language default options with any site-specific options
 820          * and add the default language variants.
 821          * Not really private cause it's called by Language class
 822          * @return array
 823          * @static
 824          * @private
 825          */
 826         static function getDefaultOptions() {
 827                 global $wgNamespacesToBeSearchedDefault;
 828                 /**
 829                  * Site defaults will override the global/language defaults
 830                  */
 831                 global $wgDefaultUserOptions, $wgContLang;
 832                 $defOpt = $wgDefaultUserOptions + $wgContLang->getDefaultUserOptionOverrides();
 833
 834                 /**
 835                  * default language setting
 836                  */
 837                 $variant = $wgContLang->getPreferredVariant( false );
 838                 $defOpt['variant'] = $variant;
 839                 $defOpt['language'] = $variant;
 840
 841                 foreach( $wgNamespacesToBeSearchedDefault as $nsnum => $val ) {
 842                         $defOpt['searchNs'.$nsnum] = $val;
 843                 }
 844                 return $defOpt;
 845         }
 846
 847         /**
 848          * Get a given default option value.
 849          *
 850          * @param string $opt
 851          * @return string
 852          * @static
 853          * @public
 854          */
 855         function getDefaultOption( $opt ) {
 856                 $defOpts = User::getDefaultOptions();
 857                 if( isset( $defOpts[$opt] ) ) {
 858                         return $defOpts[$opt];
 859                 } else {
 860                         return '';
 861                 }
 862         }
 863
 864         /**
 865          * Get a list of user toggle names
 866          * @return array
 867          */
 868         static function getToggles() {
 869                 global $wgContLang;
 870                 $extraToggles = array();
 871                 wfRunHooks( 'UserToggles', array( &$extraToggles ) );
 872                 return array_merge( self::$mToggles, $extraToggles, $wgContLang->getExtraUserToggles() );
 873         }
 874
 875
 876         /**
 877          * Get blocking information
 878          * @private
 879          * @param bool $bFromSlave Specify whether to check slave or master. To improve performance,
 880          *  non-critical checks are done against slaves. Check when actually saving should be done against
 881          *  master.
 882          */
 883         function getBlockedStatus( $bFromSlave = true ) {
 884                 global $wgEnableSorbs, $wgProxyWhitelist;
 885
 886                 if ( -1 != $this->mBlockedby ) {
 887                         wfDebug( "User::getBlockedStatus: already loaded.\n" );
 888                         return;
 889                 }
 890
 891                 wfProfileIn( __METHOD__ );
 892                 wfDebug( __METHOD__.": checking...\n" );
 893
 894                 $this->mBlockedby = 0;
 895                 $this->mHideName = 0;
 896                 $ip = wfGetIP();
 897
 898                 if ($this->isAllowed( 'ipblock-exempt' ) ) {
 899                         # Exempt from all types of IP-block
 900                         $ip = '';
 901                 }
 902
 903                 # User/IP blocking
 904                 $this->mBlock = new Block();
 905                 $this->mBlock->fromMaster( !$bFromSlave );
 906                 if ( $this->mBlock->load( $ip , $this->mId ) ) {
 907                         wfDebug( __METHOD__.": Found block.\n" );
 908                         $this->mBlockedby = $this->mBlock->mBy;
 909                         $this->mBlockreason = $this->mBlock->mReason;
 910                         $this->mHideName = $this->mBlock->mHideName;
 911                         if ( $this->isLoggedIn() ) {
 912                                 $this->spreadBlock();
 913                         }
 914                 } else {
 915                         $this->mBlock = null;
 916                         wfDebug( __METHOD__.": No block.\n" );
 917                 }
 918
 919                 # Proxy blocking
 920                 if ( !$this->isAllowed('proxyunbannable') && !in_array( $ip, $wgProxyWhitelist ) ) {
 921
 922                         # Local list
 923                         if ( wfIsLocallyBlockedProxy( $ip ) ) {
 924                                 $this->mBlockedby = wfMsg( 'proxyblocker' );
 925                                 $this->mBlockreason = wfMsg( 'proxyblockreason' );
 926                         }
 927
 928                         # DNSBL
 929                         if ( !$this->mBlockedby && $wgEnableSorbs && !$this->getID() ) {
 930                                 if ( $this->inSorbsBlacklist( $ip ) ) {
 931                                         $this->mBlockedby = wfMsg( 'sorbs' );
 932                                         $this->mBlockreason = wfMsg( 'sorbsreason' );
 933                                 }
 934                         }
 935                 }
 936
 937                 # Extensions
 938                 wfRunHooks( 'GetBlockedStatus', array( &$this ) );
 939
 940                 wfProfileOut( __METHOD__ );
 941         }
 942
 943         function inSorbsBlacklist( $ip ) {
 944                 global $wgEnableSorbs, $wgSorbsUrl;
 945
 946                 return $wgEnableSorbs &&
 947                         $this->inDnsBlacklist( $ip, $wgSorbsUrl );
 948         }
 949
 950         function inDnsBlacklist( $ip, $base ) {
 951                 wfProfileIn( __METHOD__ );
 952
 953                 $found = false;
 954                 $host = '';
 955
 956                 $m = array();
 957                 if ( preg_match( '/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/', $ip, $m ) ) {
 958                         # Make hostname
 959                         for ( $i=4; $i>=1; $i-- ) {
 960                                 $host .= $m[$i] . '.';
 961                         }
 962                         $host .= $base;
 963
 964                         # Send query
 965                         $ipList = gethostbynamel( $host );
 966
 967                         if ( $ipList ) {
 968                                 wfDebug( "Hostname $host is {$ipList[0]}, it's a proxy says $base!\n" );
 969                                 $found = true;
 970                         } else {
 971                                 wfDebug( "Requested $host, not found in $base.\n" );
 972                         }
 973                 }
 974
 975                 wfProfileOut( __METHOD__ );
 976                 return $found;
 977         }
 978
 979         /**
 980          * Is this user subject to rate limiting?
 981          *
 982          * @return bool
 983          */
 984         public function isPingLimitable() {
 985                 global $wgRateLimitsExcludedGroups;
 986                 return array_intersect($this->getEffectiveGroups(), $wgRateLimitsExcludedGroups) == array();
 987         }
 988
 989         /**
 990          * Primitive rate limits: enforce maximum actions per time period
 991          * to put a brake on flooding.
 992          *
 993          * Note: when using a shared cache like memcached, IP-address
 994          * last-hit counters will be shared across wikis.
 995          *
 996          * @return bool true if a rate limiter was tripped
 997          * @public
 998          */
 999         function pingLimiter( $action='edit' ) {
1000
1001                 # Call the 'PingLimiter' hook
1002                 $result = false;
1003                 if( !wfRunHooks( 'PingLimiter', array( &$this, $action, $result ) ) ) {
1004                         return $result;
1005                 }
1006
1007                 global $wgRateLimits, $wgRateLimitsExcludedGroups;
1008                 if( !isset( $wgRateLimits[$action] ) ) {
1009                         return false;
1010                 }
1011
1012                 # Some groups shouldn't trigger the ping limiter, ever
1013                 if( !$this->isPingLimitable() )
1014                         return false;
1015
1016                 global $wgMemc, $wgRateLimitLog;
1017                 wfProfileIn( __METHOD__ );
1018
1019                 $limits = $wgRateLimits[$action];
1020                 $keys = array();
1021                 $id = $this->getId();
1022                 $ip = wfGetIP();
1023
1024                 if( isset( $limits['anon'] ) && $id == 0 ) {
1025                         $keys[wfMemcKey( 'limiter', $action, 'anon' )] = $limits['anon'];
1026                 }
1027
1028                 if( isset( $limits['user'] ) && $id != 0 ) {
1029                         $keys[wfMemcKey( 'limiter', $action, 'user', $id )] = $limits['user'];
1030                 }
1031                 if( $this->isNewbie() ) {
1032                         if( isset( $limits['newbie'] ) && $id != 0 ) {
1033                                 $keys[wfMemcKey( 'limiter', $action, 'user', $id )] = $limits['newbie'];
1034                         }
1035                         if( isset( $limits['ip'] ) ) {
1036                                 $keys["mediawiki:limiter:$action:ip:$ip"] = $limits['ip'];
1037                         }
1038                         $matches = array();
1039                         if( isset( $limits['subnet'] ) && preg_match( '/^(\d+\.\d+\.\d+)\.\d+$/', $ip, $matches ) ) {
1040                                 $subnet = $matches[1];
1041                                 $keys["mediawiki:limiter:$action:subnet:$subnet"] = $limits['subnet'];
1042                         }
1043                 }
1044
1045                 $triggered = false;
1046                 foreach( $keys as $key => $limit ) {
1047                         list( $max, $period ) = $limit;
1048                         $summary = "(limit $max in {$period}s)";
1049                         $count = $wgMemc->get( $key );
1050                         if( $count ) {
1051                                 if( $count > $max ) {
1052                                         wfDebug( __METHOD__.": tripped! $key at $count $summary\n" );
1053                                         if( $wgRateLimitLog ) {
1054                                                 @error_log( wfTimestamp( TS_MW ) . ' ' . wfWikiID() . ': ' . $this->getName() . " tripped $key at $count $summary\n", 3, $wgRateLimitLog );
1055                                         }
1056                                         $triggered = true;
1057                                 } else {
1058                                         wfDebug( __METHOD__.": ok. $key at $count $summary\n" );
1059                                 }
1060                         } else {
1061                                 wfDebug( __METHOD__.": adding record for $key $summary\n" );
1062                                 $wgMemc->add( $key, 1, intval( $period ) );
1063                         }
1064                         $wgMemc->incr( $key );
1065                 }
1066
1067                 wfProfileOut( __METHOD__ );
1068                 return $triggered;
1069         }
1070
1071         /**
1072          * Check if user is blocked
1073          * @return bool True if blocked, false otherwise
1074          */
1075         function isBlocked( $bFromSlave = true ) { // hacked from false due to horrible probs on site
1076                 wfDebug( "User::isBlocked: enter\n" );
1077                 $this->getBlockedStatus( $bFromSlave );
1078                 return $this->mBlockedby !== 0;
1079         }
1080
1081         /**
1082          * Check if user is blocked from editing a particular article
1083          */
1084         function isBlockedFrom( $title, $bFromSlave = false ) {
1085                 global $wgBlockAllowsUTEdit;
1086                 wfProfileIn( __METHOD__ );
1087                 wfDebug( __METHOD__.": enter\n" );
1088
1089                 wfDebug( __METHOD__.": asking isBlocked()\n" );
1090                 $blocked = $this->isBlocked( $bFromSlave );
1091                 # If a user's name is suppressed, they cannot make edits anywhere
1092                 if ( !$this->mHideName && $wgBlockAllowsUTEdit && $title->getText() === $this->getName() &&
1093                   $title->getNamespace() == NS_USER_TALK ) {
1094                         $blocked = false;
1095                         wfDebug( __METHOD__.": self-talk page, ignoring any blocks\n" );
1096                 }
1097                 wfProfileOut( __METHOD__ );
1098                 return $blocked;
1099         }
1100
1101         /**
1102          * Get name of blocker
1103          * @return string name of blocker
1104          */
1105         function blockedBy() {
1106                 $this->getBlockedStatus();
1107                 return $this->mBlockedby;
1108         }
1109
1110         /**
1111          * Get blocking reason
1112          * @return string Blocking reason
1113          */
1114         function blockedFor() {
1115                 $this->getBlockedStatus();
1116                 return $this->mBlockreason;
1117         }
1118
1119         /**
1120          * Get the user ID. Returns 0 if the user is anonymous or nonexistent.
1121          */
1122         function getID() {
1123                 $this->load();
1124                 return $this->mId;
1125         }
1126
1127         /**
1128          * Set the user and reload all fields according to that ID
1129          * @deprecated use User::newFromId()
1130          */
1131         function setID( $v ) {
1132                 $this->mId = $v;
1133                 $this->clearInstanceCache( 'id' );
1134         }
1135
1136         /**
1137          * Get the user name, or the IP for anons
1138          */
1139         function getName() {
1140                 if ( !$this->mDataLoaded && $this->mFrom == 'name' ) {
1141                         # Special case optimisation
1142                         return $this->mName;
1143                 } else {
1144                         $this->load();
1145                         if ( $this->mName === false ) {
1146                                 # Clean up IPs
1147                                 $this->mName = IP::sanitizeIP( wfGetIP() );
1148                         }
1149                         return $this->mName;
1150                 }
1151         }
1152
1153         /**
1154          * Set the user name.
1155          *
1156          * This does not reload fields from the database according to the given
1157          * name. Rather, it is used to create a temporary "nonexistent user" for
1158          * later addition to the database. It can also be used to set the IP
1159          * address for an anonymous user to something other than the current
1160          * remote IP.
1161          *
1162          * User::newFromName() has rougly the same function, when the named user
1163          * does not exist.
1164          */
1165         function setName( $str ) {
1166                 $this->load();
1167                 $this->mName = $str;
1168         }
1169
1170         /**
1171          * Return the title dbkey form of the name, for eg user pages.
1172          * @return string
1173          * @public
1174          */
1175         function getTitleKey() {
1176                 return str_replace( ' ', '_', $this->getName() );
1177         }
1178
1179         function getNewtalk() {
1180                 $this->load();
1181
1182                 # Load the newtalk status if it is unloaded (mNewtalk=-1)
1183                 if( $this->mNewtalk === -1 ) {
1184                         $this->mNewtalk = false; # reset talk page status
1185
1186                         # Check memcached separately for anons, who have no
1187                         # entire User object stored in there.
1188                         if( !$this->mId ) {
1189                                 global $wgMemc;
1190                                 $key = wfMemcKey( 'newtalk', 'ip', $this->getName() );
1191                                 $newtalk = $wgMemc->get( $key );
1192                                 if( $newtalk != "" ) {
1193                                         $this->mNewtalk = (bool)$newtalk;
1194                                 } else {
1195                                         $this->mNewtalk = $this->checkNewtalk( 'user_ip', $this->getName() );
1196                                         $wgMemc->set( $key, (int)$this->mNewtalk, time() + 1800 );
1197                                 }
1198                         } else {
1199                                 $this->mNewtalk = $this->checkNewtalk( 'user_id', $this->mId );
1200                         }
1201                 }
1202
1203                 return (bool)$this->mNewtalk;
1204         }
1205
1206         /**
1207          * Return the talk page(s) this user has new messages on.
1208          */
1209         function getNewMessageLinks() {
1210                 $talks = array();
1211                 if (!wfRunHooks('UserRetrieveNewTalks', array(&$this, &$talks)))
1212                         return $talks;
1213
1214                 if (!$this->getNewtalk())
1215                         return array();
1216                 $up = $this->getUserPage();
1217                 $utp = $up->getTalkPage();
1218                 return array(array("wiki" => wfWikiID(), "link" => $utp->getLocalURL()));
1219         }
1220
1221
1222         /**
1223          * Perform a user_newtalk check on current slaves; if the memcached data
1224          * is funky we don't want newtalk state to get stuck on save, as that's
1225          * damn annoying.
1226          *
1227          * @param string $field
1228          * @param mixed $id
1229          * @return bool
1230          * @private
1231          */
1232         function checkNewtalk( $field, $id ) {
1233                 $dbr = wfGetDB( DB_SLAVE );
1234                 $ok = $dbr->selectField( 'user_newtalk', $field,
1235                         array( $field => $id ), __METHOD__ );
1236                 return $ok !== false;
1237         }
1238
1239         /**
1240          * Add or update the
1241          * @param string $field
1242          * @param mixed $id
1243          * @private
1244          */
1245         function updateNewtalk( $field, $id ) {
1246                 if( $this->checkNewtalk( $field, $id ) ) {
1247                         wfDebug( __METHOD__." already set ($field, $id), ignoring\n" );
1248                         return false;
1249                 }
1250                 $dbw = wfGetDB( DB_MASTER );
1251                 $dbw->insert( 'user_newtalk',
1252                         array( $field => $id ),
1253                         __METHOD__,
1254                         'IGNORE' );
1255                 wfDebug( __METHOD__.": set on ($field, $id)\n" );
1256                 return true;
1257         }
1258
1259         /**
1260          * Clear the new messages flag for the given user
1261          * @param string $field
1262          * @param mixed $id
1263          * @private
1264          */
1265         function deleteNewtalk( $field, $id ) {
1266                 if( !$this->checkNewtalk( $field, $id ) ) {
1267                         wfDebug( __METHOD__.": already gone ($field, $id), ignoring\n" );
1268                         return false;
1269                 }
1270                 $dbw = wfGetDB( DB_MASTER );
1271                 $dbw->delete( 'user_newtalk',
1272                         array( $field => $id ),
1273                         __METHOD__ );
1274                 wfDebug( __METHOD__.": killed on ($field, $id)\n" );
1275                 return true;
1276         }
1277
1278         /**
1279          * Update the 'You have new messages!' status.
1280          * @param bool $val
1281          */
1282         function setNewtalk( $val ) {
1283                 if( wfReadOnly() ) {
1284                         return;
1285                 }
1286
1287                 $this->load();
1288                 $this->mNewtalk = $val;
1289
1290                 if( $this->isAnon() ) {
1291                         $field = 'user_ip';
1292                         $id = $this->getName();
1293                 } else {
1294                         $field = 'user_id';
1295                         $id = $this->getId();
1296                 }
1297
1298                 if( $val ) {
1299                         $changed = $this->updateNewtalk( $field, $id );
1300                 } else {
1301                         $changed = $this->deleteNewtalk( $field, $id );
1302                 }
1303
1304                 if( $changed ) {
1305                         if( $this->isAnon() ) {
1306                                 // Anons have a separate memcached space, since
1307                                 // user records aren't kept for them.
1308                                 global $wgMemc;
1309                                 $key = wfMemcKey( 'newtalk', 'ip', $val );
1310                                 $wgMemc->set( $key, $val ? 1 : 0 );
1311                         } else {
1312                                 if( $val ) {
1313                                         // Make sure the user page is watched, so a notification
1314                                         // will be sent out if enabled.
1315                                         $this->addWatch( $this->getTalkPage() );
1316                                 }
1317                         }
1318                         $this->invalidateCache();
1319                 }
1320         }
1321
1322         /**
1323          * Generate a current or new-future timestamp to be stored in the
1324          * user_touched field when we update things.
1325          */
1326         private static function newTouchedTimestamp() {
1327                 global $wgClockSkewFudge;
1328                 return wfTimestamp( TS_MW, time() + $wgClockSkewFudge );
1329         }
1330
1331         /**
1332          * Clear user data from memcached.
1333          * Use after applying fun updates to the database; caller's
1334          * responsibility to update user_touched if appropriate.
1335          *
1336          * Called implicitly from invalidateCache() and saveSettings().
1337          */
1338         private function clearSharedCache() {
1339                 if( $this->mId ) {
1340                         global $wgMemc;
1341                         $wgMemc->delete( wfMemcKey( 'user', 'id', $this->mId ) );
1342                 }
1343         }
1344
1345         /**
1346          * Immediately touch the user data cache for this account.
1347          * Updates user_touched field, and removes account data from memcached
1348          * for reload on the next hit.
1349          */
1350         function invalidateCache() {
1351                 $this->load();
1352                 if( $this->mId ) {
1353                         $this->mTouched = self::newTouchedTimestamp();
1354
1355                         $dbw = wfGetDB( DB_MASTER );
1356                         $dbw->update( 'user',
1357                                 array( 'user_touched' => $dbw->timestamp( $this->mTouched ) ),
1358                                 array( 'user_id' => $this->mId ),
1359                                 __METHOD__ );
1360
1361                         $this->clearSharedCache();
1362                 }
1363         }
1364
1365         function validateCache( $timestamp ) {
1366                 $this->load();
1367                 return ($timestamp >= $this->mTouched);
1368         }
1369
1370         /**
1371          * Encrypt a password.
1372          * It can eventually salt a password.
1373          * @see User::addSalt()
1374          * @param string $p clear Password.
1375          * @return string Encrypted password.
1376          */
1377         function encryptPassword( $p ) {
1378                 $this->load();
1379                 return wfEncryptPassword( $this->mId, $p );
1380         }
1381
1382         /**
1383          * Set the password and reset the random token
1384          * Calls through to authentication plugin if necessary;
1385          * will have no effect if the auth plugin refuses to
1386          * pass the change through or if the legal password
1387          * checks fail.
1388          *
1389          * As a special case, setting the password to null
1390          * wipes it, so the account cannot be logged in until
1391          * a new password is set, for instance via e-mail.
1392          *
1393          * @param string $str
1394          * @throws PasswordError on failure
1395          */
1396         function setPassword( $str ) {
1397                 global $wgAuth;
1398
1399                 if( $str !== null ) {
1400                         if( !$wgAuth->allowPasswordChange() ) {
1401                                 throw new PasswordError( wfMsg( 'password-change-forbidden' ) );
1402                         }
1403
1404                         if( !$this->isValidPassword( $str ) ) {
1405                                 global $wgMinimalPasswordLength;
1406                                 throw new PasswordError( wfMsg( 'passwordtooshort',
1407                                         $wgMinimalPasswordLength ) );
1408                         }
1409                 }
1410
1411                 if( !$wgAuth->setPassword( $this, $str ) ) {
1412                         throw new PasswordError( wfMsg( 'externaldberror' ) );
1413                 }
1414
1415                 $this->setInternalPassword( $str );
1416
1417                 return true;
1418         }
1419
1420         /**
1421          * Set the password and reset the random token no matter
1422          * what.
1423          *
1424          * @param string $str
1425          */
1426         function setInternalPassword( $str ) {
1427                 $this->load();
1428                 $this->setToken();
1429
1430                 if( $str === null ) {
1431                         // Save an invalid hash...
1432                         $this->mPassword = '';
1433                 } else {
1434                         $this->mPassword = $this->encryptPassword( $str );
1435                 }
1436                 $this->mNewpassword = '';
1437                 $this->mNewpassTime = null;
1438         }
1439         /**
1440          * Set the random token (used for persistent authentication)
1441          * Called from loadDefaults() among other places.
1442          * @private
1443          */
1444         function setToken( $token = false ) {
1445                 global $wgSecretKey, $wgProxyKey;
1446                 $this->load();
1447                 if ( !$token ) {
1448                         if ( $wgSecretKey ) {
1449                                 $key = $wgSecretKey;
1450                         } elseif ( $wgProxyKey ) {
1451                                 $key = $wgProxyKey;
1452                         } else {
1453                                 $key = microtime();
1454                         }
1455                         $this->mToken = md5( $key . mt_rand( 0, 0x7fffffff ) . wfWikiID() . $this->mId );
1456                 } else {
1457                         $this->mToken = $token;
1458                 }
1459         }
1460
1461         function setCookiePassword( $str ) {
1462                 $this->load();
1463                 $this->mCookiePassword = md5( $str );
1464         }
1465
1466         /**
1467          * Set the password for a password reminder or new account email
1468          * Sets the user_newpass_time field if $throttle is true
1469          */
1470         function setNewpassword( $str, $throttle = true ) {
1471                 $this->load();
1472                 $this->mNewpassword = $this->encryptPassword( $str );
1473                 if ( $throttle ) {
1474                         $this->mNewpassTime = wfTimestampNow();
1475                 }
1476         }
1477
1478         /**
1479          * Returns true if a password reminder email has already been sent within
1480          * the last $wgPasswordReminderResendTime hours
1481          */
1482         function isPasswordReminderThrottled() {
1483                 global $wgPasswordReminderResendTime;
1484                 $this->load();
1485                 if ( !$this->mNewpassTime || !$wgPasswordReminderResendTime ) {
1486                         return false;
1487                 }
1488                 $expiry = wfTimestamp( TS_UNIX, $this->mNewpassTime ) + $wgPasswordReminderResendTime * 3600;
1489                 return time() < $expiry;
1490         }
1491
1492         function getEmail() {
1493                 $this->load();
1494                 return $this->mEmail;
1495         }
1496
1497         function getEmailAuthenticationTimestamp() {
1498                 $this->load();
1499                 return $this->mEmailAuthenticated;
1500         }
1501
1502         function setEmail( $str ) {
1503                 $this->load();
1504                 $this->mEmail = $str;
1505         }
1506
1507         function getRealName() {
1508                 $this->load();
1509                 return $this->mRealName;
1510         }
1511
1512         function setRealName( $str ) {
1513                 $this->load();
1514                 $this->mRealName = $str;
1515         }
1516
1517         /**
1518          * @param string $oname The option to check
1519          * @param string $defaultOverride A default value returned if the option does not exist
1520          * @return string
1521          */
1522         function getOption( $oname, $defaultOverride = '' ) {
1523                 $this->load();
1524
1525                 if ( is_null( $this->mOptions ) ) {
1526                         if($defaultOverride != '') {
1527                                 return $defaultOverride;
1528                         }
1529                         $this->mOptions = User::getDefaultOptions();
1530                 }
1531
1532                 if ( array_key_exists( $oname, $this->mOptions ) ) {
1533                         return trim( $this->mOptions[$oname] );
1534                 } else {
1535                         return $defaultOverride;
1536                 }
1537         }
1538
1539         /**
1540          * Get the user's date preference, including some important migration for
1541          * old user rows.
1542          */
1543         function getDatePreference() {
1544                 if ( is_null( $this->mDatePreference ) ) {
1545                         global $wgLang;
1546                         $value = $this->getOption( 'date' );
1547                         $map = $wgLang->getDatePreferenceMigrationMap();
1548                         if ( isset( $map[$value] ) ) {
1549                                 $value = $map[$value];
1550                         }
1551                         $this->mDatePreference = $value;
1552                 }
1553                 return $this->mDatePreference;
1554         }
1555
1556         /**
1557          * @param string $oname The option to check
1558          * @return bool False if the option is not selected, true if it is
1559          */
1560         function getBoolOption( $oname ) {
1561                 return (bool)$this->getOption( $oname );
1562         }
1563
1564         /**
1565          * Get an option as an integer value from the source string.
1566          * @param string $oname The option to check
1567          * @param int $default Optional value to return if option is unset/blank.
1568          * @return int
1569          */
1570         function getIntOption( $oname, $default=0 ) {
1571                 $val = $this->getOption( $oname );
1572                 if( $val == '' ) {
1573                         $val = $default;
1574                 }
1575                 return intval( $val );
1576         }
1577
1578         function setOption( $oname, $val ) {
1579                 $this->load();
1580                 if ( is_null( $this->mOptions ) ) {
1581                         $this->mOptions = User::getDefaultOptions();
1582                 }
1583                 if ( $oname == 'skin' ) {
1584                         # Clear cached skin, so the new one displays immediately in Special:Preferences
1585                         unset( $this->mSkin );
1586                 }
1587                 // Filter out any newlines that may have passed through input validation.
1588                 // Newlines are used to separate items in the options blob.
1589                 $val = str_replace( "\r\n", "\n", $val );
1590                 $val = str_replace( "\r", "\n", $val );
1591                 $val = str_replace( "\n", " ", $val );
1592                 $this->mOptions[$oname] = $val;
1593         }
1594
1595         function getRights() {
1596                 if ( is_null( $this->mRights ) ) {
1597                         $this->mRights = self::getGroupPermissions( $this->getEffectiveGroups() );
1598                 }
1599                 return $this->mRights;
1600         }
1601
1602         /**
1603          * Get the list of explicit group memberships this user has.
1604          * The implicit * and user groups are not included.
1605          * @return array of strings
1606          */
1607         function getGroups() {
1608                 $this->load();
1609                 return $this->mGroups;
1610         }
1611
1612         /**
1613          * Get the list of implicit group memberships this user has.
1614          * This includes all explicit groups, plus 'user' if logged in
1615          * and '*' for all accounts.
1616          * @param boolean $recache Don't use the cache
1617          * @return array of strings
1618          */
1619         function getEffectiveGroups( $recache = false ) {
1620                 if ( $recache || is_null( $this->mEffectiveGroups ) ) {
1621                         $this->load();
1622                         $this->mEffectiveGroups = $this->mGroups;
1623                         $this->mEffectiveGroups[] = '*';
1624                         if( $this->mId ) {
1625                                 $this->mEffectiveGroups[] = 'user';
1626
1627                                 global $wgAutoConfirmAge, $wgAutoConfirmCount;
1628
1629                                 $accountAge = time() - wfTimestampOrNull( TS_UNIX, $this->mRegistration );
1630                                 if( $accountAge >= $wgAutoConfirmAge && $this->getEditCount() >= $wgAutoConfirmCount ) {
1631                                         $this->mEffectiveGroups[] = 'autoconfirmed';
1632                                 }
1633                                 # Implicit group for users whose email addresses are confirmed
1634                                 global $wgEmailAuthentication;
1635                                 if( self::isValidEmailAddr( $this->mEmail ) ) {
1636                                         if( $wgEmailAuthentication ) {
1637                                                 if( $this->mEmailAuthenticated )
1638                                                         $this->mEffectiveGroups[] = 'emailconfirmed';
1639                                         } else {
1640                                                 $this->mEffectiveGroups[] = 'emailconfirmed';
1641                                         }
1642                                 }
1643                                 # Hook for additional groups
1644                                 wfRunHooks( 'UserEffectiveGroups', array( &$this, &$this->mEffectiveGroups ) );
1645                         }
1646                 }
1647                 return $this->mEffectiveGroups;
1648         }
1649
1650         /* Return the edit count for the user. This is where User::edits should have been */
1651         function getEditCount() {
1652                 if ($this->mId) {
1653                         if ( !isset( $this->mEditCount ) ) {
1654                                 /* Populate the count, if it has not been populated yet */
1655                                 $this->mEditCount = User::edits($this->mId);
1656                         }
1657                         return $this->mEditCount;
1658                 } else {
1659                         /* nil */
1660                         return null;
1661                 }
1662         }
1663
1664         /**
1665          * Add the user to the given group.
1666          * This takes immediate effect.
1667          * @param string $group
1668          */
1669         function addGroup( $group ) {
1670                 $this->load();
1671                 $dbw = wfGetDB( DB_MASTER );
1672                 if( $this->getId() ) {
1673                         $dbw->insert( 'user_groups',
1674                                 array(
1675                                         'ug_user'  => $this->getID(),
1676                                         'ug_group' => $group,
1677                                 ),
1678                                 'User::addGroup',
1679                                 array( 'IGNORE' ) );
1680                 }
1681
1682                 $this->mGroups[] = $group;
1683                 $this->mRights = User::getGroupPermissions( $this->getEffectiveGroups( true ) );
1684
1685                 $this->invalidateCache();
1686         }
1687
1688         /**
1689          * Remove the user from the given group.
1690          * This takes immediate effect.
1691          * @param string $group
1692          */
1693         function removeGroup( $group ) {
1694                 $this->load();
1695                 $dbw = wfGetDB( DB_MASTER );
1696                 $dbw->delete( 'user_groups',
1697                         array(
1698                                 'ug_user'  => $this->getID(),
1699                                 'ug_group' => $group,
1700                         ),
1701                         'User::removeGroup' );
1702
1703                 $this->mGroups = array_diff( $this->mGroups, array( $group ) );
1704                 $this->mRights = User::getGroupPermissions( $this->getEffectiveGroups( true ) );
1705
1706                 $this->invalidateCache();
1707         }
1708
1709
1710         /**
1711          * A more legible check for non-anonymousness.
1712          * Returns true if the user is not an anonymous visitor.
1713          *
1714          * @return bool
1715          */
1716         function isLoggedIn() {
1717                 return( $this->getID() != 0 );
1718         }
1719
1720         /**
1721          * A more legible check for anonymousness.
1722          * Returns true if the user is an anonymous visitor.
1723          *
1724          * @return bool
1725          */
1726         function isAnon() {
1727                 return !$this->isLoggedIn();
1728         }
1729
1730         /**
1731          * Whether the user is a bot
1732          * @deprecated
1733          */
1734         function isBot() {
1735                 return $this->isAllowed( 'bot' );
1736         }
1737
1738         /**
1739          * Check if user is allowed to access a feature / make an action
1740          * @param string $action Action to be checked
1741          * @return boolean True: action is allowed, False: action should not be allowed
1742          */
1743         function isAllowed($action='') {
1744                 if ( $action === '' )
1745                         // In the spirit of DWIM
1746                         return true;
1747
1748                 return in_array( $action, $this->getRights() );
1749         }
1750
1751         /**
1752          * Load a skin if it doesn't exist or return it
1753          * @todo FIXME : need to check the old failback system [AV]
1754          */
1755         function &getSkin() {
1756                 global $wgRequest;
1757                 if ( ! isset( $this->mSkin ) ) {
1758                         wfProfileIn( __METHOD__ );
1759
1760                         # get the user skin
1761                         $userSkin = $this->getOption( 'skin' );
1762                         $userSkin = $wgRequest->getVal('useskin', $userSkin);
1763
1764                         $this->mSkin =& Skin::newFromKey( $userSkin );
1765                         wfProfileOut( __METHOD__ );
1766                 }
1767                 return $this->mSkin;
1768         }
1769
1770         /**#@+
1771          * @param string $title Article title to look at
1772          */
1773
1774         /**
1775          * Check watched status of an article
1776          * @return bool True if article is watched
1777          */
1778         function isWatched( $title ) {
1779                 $wl = WatchedItem::fromUserTitle( $this, $title );
1780                 return $wl->isWatched();
1781         }
1782
1783         /**
1784          * Watch an article
1785          */
1786         function addWatch( $title ) {
1787                 $wl = WatchedItem::fromUserTitle( $this, $title );
1788                 $wl->addWatch();
1789                 $this->invalidateCache();
1790         }
1791
1792         /**
1793          * Stop watching an article
1794          */
1795         function removeWatch( $title ) {
1796                 $wl = WatchedItem::fromUserTitle( $this, $title );
1797                 $wl->removeWatch();
1798                 $this->invalidateCache();
1799         }
1800
1801         /**
1802          * Clear the user's notification timestamp for the given title.
1803          * If e-notif e-mails are on, they will receive notification mails on
1804          * the next change of the page if it's watched etc.
1805          */
1806         function clearNotification( &$title ) {
1807                 global $wgUser, $wgUseEnotif;
1808
1809                 # Do nothing if the database is locked to writes
1810                 if( wfReadOnly() ) {
1811                         return;
1812                 }
1813
1814                 if ($title->getNamespace() == NS_USER_TALK &&
1815                         $title->getText() == $this->getName() ) {
1816                         if (!wfRunHooks('UserClearNewTalkNotification', array(&$this)))
1817                                 return;
1818                         $this->setNewtalk( false );
1819                 }
1820
1821                 if( !$wgUseEnotif ) {
1822                         return;
1823                 }
1824
1825                 if( $this->isAnon() ) {
1826                         // Nothing else to do...
1827                         return;
1828                 }
1829
1830                 // Only update the timestamp if the page is being watched.
1831                 // The query to find out if it is watched is cached both in memcached and per-invocation,
1832                 // and when it does have to be executed, it can be on a slave
1833                 // If this is the user's newtalk page, we always update the timestamp
1834                 if ($title->getNamespace() == NS_USER_TALK &&
1835                         $title->getText() == $wgUser->getName())
1836                 {
1837                         $watched = true;
1838                 } elseif ( $this->getID() == $wgUser->getID() ) {
1839                         $watched = $title->userIsWatching();
1840                 } else {
1841                         $watched = true;
1842                 }
1843
1844                 // If the page is watched by the user (or may be watched), update the timestamp on any
1845                 // any matching rows
1846                 if ( $watched ) {
1847                         $dbw = wfGetDB( DB_MASTER );
1848                         $dbw->update( 'watchlist',
1849                                         array( /* SET */
1850                                                 'wl_notificationtimestamp' => NULL
1851                                         ), array( /* WHERE */
1852                                                 'wl_title' => $title->getDBkey(),
1853                                                 'wl_namespace' => $title->getNamespace(),
1854                                                 'wl_user' => $this->getID()
1855                                         ), 'User::clearLastVisited'
1856                         );
1857                 }
1858         }
1859
1860         /**#@-*/
1861
1862         /**
1863          * Resets all of the given user's page-change notification timestamps.
1864          * If e-notif e-mails are on, they will receive notification mails on
1865          * the next change of any watched page.
1866          *
1867          * @param int $currentUser user ID number
1868          * @public
1869          */
1870         function clearAllNotifications( $currentUser ) {
1871                 global $wgUseEnotif;
1872                 if ( !$wgUseEnotif ) {
1873                         $this->setNewtalk( false );
1874                         return;
1875                 }
1876                 if( $currentUser != 0 )  {
1877
1878                         $dbw = wfGetDB( DB_MASTER );
1879                         $dbw->update( 'watchlist',
1880                                 array( /* SET */
1881                                         'wl_notificationtimestamp' => NULL
1882                                 ), array( /* WHERE */
1883                                         'wl_user' => $currentUser
1884                                 ), 'UserMailer::clearAll'
1885                         );
1886
1887                 #       we also need to clear here the "you have new message" notification for the own user_talk page
1888                 #       This is cleared one page view later in Article::viewUpdates();
1889                 }
1890         }
1891
1892         /**
1893          * @private
1894          * @return string Encoding options
1895          */
1896         function encodeOptions() {
1897                 $this->load();
1898                 if ( is_null( $this->mOptions ) ) {
1899                         $this->mOptions = User::getDefaultOptions();
1900                 }
1901                 $a = array();
1902                 foreach ( $this->mOptions as $oname => $oval ) {
1903                         array_push( $a, $oname.'='.$oval );
1904                 }
1905                 $s = implode( "\n", $a );
1906                 return $s;
1907         }
1908
1909         /**
1910          * @private
1911          */
1912         function decodeOptions( $str ) {
1913                 $this->mOptions = array();
1914                 $a = explode( "\n", $str );
1915                 foreach ( $a as $s ) {
1916                         $m = array();
1917                         if ( preg_match( "/^(.[^=]*)=(.*)$/", $s, $m ) ) {
1918                                 $this->mOptions[$m[1]] = $m[2];
1919                         }
1920                 }
1921         }
1922
1923         function setCookies() {
1924                 global $wgCookieExpiration, $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookiePrefix;
1925                 $this->load();
1926                 if ( 0 == $this->mId ) return;
1927                 $exp = time() + $wgCookieExpiration;
1928
1929                 $_SESSION['wsUserID'] = $this->mId;
1930                 setcookie( $wgCookiePrefix.'UserID', $this->mId, $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
1931
1932                 $_SESSION['wsUserName'] = $this->getName();
1933                 setcookie( $wgCookiePrefix.'UserName', $this->getName(), $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
1934
1935                 $_SESSION['wsToken'] = $this->mToken;
1936                 if ( 1 == $this->getOption( 'rememberpassword' ) ) {
1937                         setcookie( $wgCookiePrefix.'Token', $this->mToken, $exp, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
1938                 } else {
1939                         setcookie( $wgCookiePrefix.'Token', '', time() - 3600 );
1940                 }
1941         }
1942
1943         /**
1944          * Logout user
1945          * Clears the cookies and session, resets the instance cache
1946          */
1947         function logout() {
1948                 global $wgCookiePath, $wgCookieDomain, $wgCookieSecure, $wgCookiePrefix;
1949                 $this->clearInstanceCache( 'defaults' );
1950
1951                 $_SESSION['wsUserID'] = 0;
1952
1953                 setcookie( $wgCookiePrefix.'UserID', '', time() - 3600, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
1954                 setcookie( $wgCookiePrefix.'Token', '', time() - 3600, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
1955
1956                 # Remember when user logged out, to prevent seeing cached pages
1957                 setcookie( $wgCookiePrefix.'LoggedOut', wfTimestampNow(), time() + 86400, $wgCookiePath, $wgCookieDomain, $wgCookieSecure );
1958         }
1959
1960         /**
1961          * Save object settings into database
1962          * @todo Only rarely do all these fields need to be set!
1963          */
1964         function saveSettings() {
1965                 $this->load();
1966                 if ( wfReadOnly() ) { return; }
1967                 if ( 0 == $this->mId ) { return; }
1968
1969                 $this->mTouched = self::newTouchedTimestamp();
1970
1971                 $dbw = wfGetDB( DB_MASTER );
1972                 $dbw->update( 'user',
1973                         array( /* SET */
1974                                 'user_name' => $this->mName,
1975                                 'user_password' => $this->mPassword,
1976                                 'user_newpassword' => $this->mNewpassword,
1977                                 'user_newpass_time' => $dbw->timestampOrNull( $this->mNewpassTime ),
1978                                 'user_real_name' => $this->mRealName,
1979                                 'user_email' => $this->mEmail,
1980                                 'user_email_authenticated' => $dbw->timestampOrNull( $this->mEmailAuthenticated ),
1981                                 'user_options' => $this->encodeOptions(),
1982                                 'user_touched' => $dbw->timestamp($this->mTouched),
1983                                 'user_token' => $this->mToken
1984                         ), array( /* WHERE */
1985                                 'user_id' => $this->mId
1986                         ), __METHOD__
1987                 );
1988                 $this->clearSharedCache();
1989         }
1990
1991
1992         /**
1993          * Checks if a user with the given name exists, returns the ID
1994          */
1995         function idForName() {
1996                 $s = trim( $this->getName() );
1997                 if ( 0 == strcmp( '', $s ) ) return 0;
1998
1999                 $dbr = wfGetDB( DB_SLAVE );
2000                 $id = $dbr->selectField( 'user', 'user_id', array( 'user_name' => $s ), __METHOD__ );
2001                 if ( $id === false ) {
2002                         $id = 0;
2003                 }
2004                 return $id;
2005         }
2006
2007         /**
2008          * Add a user to the database, return the user object
2009          *
2010          * @param string $name The user's name
2011          * @param array $params Associative array of non-default parameters to save to the database:
2012          *     password             The user's password. Password logins will be disabled if this is omitted.
2013          *     newpassword          A temporary password mailed to the user
2014          *     email                The user's email address
2015          *     email_authenticated  The email authentication timestamp
2016          *     real_name            The user's real name
2017          *     options              An associative array of non-default options
2018          *     token                Random authentication token. Do not set.
2019          *     registration         Registration timestamp. Do not set.
2020          *
2021          * @return User object, or null if the username already exists
2022          */
2023         static function createNew( $name, $params = array() ) {
2024                 $user = new User;
2025                 $user->load();
2026                 if ( isset( $params['options'] ) ) {
2027                         $user->mOptions = $params['options'] + $user->mOptions;
2028                         unset( $params['options'] );
2029                 }
2030                 $dbw = wfGetDB( DB_MASTER );
2031                 $seqVal = $dbw->nextSequenceValue( 'user_user_id_seq' );
2032                 $fields = array(
2033                         'user_id' => $seqVal,
2034                         'user_name' => $name,
2035                         'user_password' => $user->mPassword,
2036                         'user_newpassword' => $user->mNewpassword,
2037                         'user_newpass_time' => $dbw->timestamp( $user->mNewpassTime ),
2038                         'user_email' => $user->mEmail,
2039                         'user_email_authenticated' => $dbw->timestampOrNull( $user->mEmailAuthenticated ),
2040                         'user_real_name' => $user->mRealName,
2041                         'user_options' => $user->encodeOptions(),
2042                         'user_token' => $user->mToken,
2043                         'user_registration' => $dbw->timestamp( $user->mRegistration ),
2044                         'user_editcount' => 0,
2045                 );
2046                 foreach ( $params as $name => $value ) {
2047                         $fields["user_$name"] = $value;
2048                 }
2049                 $dbw->insert( 'user', $fields, __METHOD__, array( 'IGNORE' ) );
2050                 if ( $dbw->affectedRows() ) {
2051                         $newUser = User::newFromId( $dbw->insertId() );
2052                 } else {
2053                         $newUser = null;
2054                 }
2055                 return $newUser;
2056         }
2057
2058         /**
2059          * Add an existing user object to the database
2060          */
2061         function addToDatabase() {
2062                 $this->load();
2063                 $dbw = wfGetDB( DB_MASTER );
2064                 $seqVal = $dbw->nextSequenceValue( 'user_user_id_seq' );
2065                 $dbw->insert( 'user',
2066                         array(
2067                                 'user_id' => $seqVal,
2068                                 'user_name' => $this->mName,
2069                                 'user_password' => $this->mPassword,
2070                                 'user_newpassword' => $this->mNewpassword,
2071                                 'user_newpass_time' => $dbw->timestamp( $this->mNewpassTime ),
2072                                 'user_email' => $this->mEmail,
2073                                 'user_email_authenticated' => $dbw->timestampOrNull( $this->mEmailAuthenticated ),
2074                                 'user_real_name' => $this->mRealName,
2075                                 'user_options' => $this->encodeOptions(),
2076                                 'user_token' => $this->mToken,
2077                                 'user_registration' => $dbw->timestamp( $this->mRegistration ),
2078                                 'user_editcount' => 0,
2079                         ), __METHOD__
2080                 );
2081                 $this->mId = $dbw->insertId();
2082
2083                 # Clear instance cache other than user table data, which is already accurate
2084                 $this->clearInstanceCache();
2085         }
2086
2087         /**
2088          * If the (non-anonymous) user is blocked, this function will block any IP address
2089          * that they successfully log on from.
2090          */
2091         function spreadBlock() {
2092                 wfDebug( __METHOD__."()\n" );
2093                 $this->load();
2094                 if ( $this->mId == 0 ) {
2095                         return;
2096                 }
2097
2098                 $userblock = Block::newFromDB( '', $this->mId );
2099                 if ( !$userblock ) {
2100                         return;
2101                 }
2102
2103                 $userblock->doAutoblock( wfGetIp() );
2104
2105         }
2106
2107         /**
2108          * Generate a string which will be different for any combination of
2109          * user options which would produce different parser output.
2110          * This will be used as part of the hash key for the parser cache,
2111          * so users will the same options can share the same cached data
2112          * safely.
2113          *
2114          * Extensions which require it should install 'PageRenderingHash' hook,
2115          * which will give them a chance to modify this key based on their own
2116          * settings.
2117          *
2118          * @return string
2119          */
2120         function getPageRenderingHash() {
2121                 global $wgContLang, $wgUseDynamicDates, $wgLang;
2122                 if( $this->mHash ){
2123                         return $this->mHash;
2124                 }
2125
2126                 // stubthreshold is only included below for completeness,
2127                 // it will always be 0 when this function is called by parsercache.
2128
2129                 $confstr =        $this->getOption( 'math' );
2130                 $confstr .= '!' . $this->getOption( 'stubthreshold' );
2131                 if ( $wgUseDynamicDates ) {
2132                         $confstr .= '!' . $this->getDatePreference();
2133                 }
2134                 $confstr .= '!' . ($this->getOption( 'numberheadings' ) ? '1' : '');
2135                 $confstr .= '!' . $wgLang->getCode();
2136                 $confstr .= '!' . $this->getOption( 'thumbsize' );
2137                 // add in language specific options, if any
2138                 $extra = $wgContLang->getExtraHashOptions();
2139                 $confstr .= $extra;
2140
2141                 // Give a chance for extensions to modify the hash, if they have
2142                 // extra options or other effects on the parser cache.
2143                 wfRunHooks( 'PageRenderingHash', array( &$confstr ) );
2144
2145                 // Make it a valid memcached key fragment
2146                 $confstr = str_replace( ' ', '_', $confstr );
2147                 $this->mHash = $confstr;
2148                 return $confstr;
2149         }
2150
2151         function isBlockedFromCreateAccount() {
2152                 $this->getBlockedStatus();
2153                 return $this->mBlock && $this->mBlock->mCreateAccount;
2154         }
2155
2156         /**
2157          * Determine if the user is blocked from using Special:Emailuser.
2158          *
2159          * @public
2160          * @return boolean
2161          */
2162         function isBlockedFromEmailuser() {
2163                 $this->getBlockedStatus();
2164                 return $this->mBlock && $this->mBlock->mBlockEmail;
2165         }
2166
2167         function isAllowedToCreateAccount() {
2168                 return $this->isAllowed( 'createaccount' ) && !$this->isBlockedFromCreateAccount();
2169         }
2170
2171         /**
2172          * @deprecated
2173          */
2174         function setLoaded( $loaded ) {}
2175
2176         /**
2177          * Get this user's personal page title.
2178          *
2179          * @return Title
2180          * @public
2181          */
2182         function getUserPage() {
2183                 return Title::makeTitle( NS_USER, $this->getName() );
2184         }
2185
2186         /**
2187          * Get this user's talk page title.
2188          *
2189          * @return Title
2190          * @public
2191          */
2192         function getTalkPage() {
2193                 $title = $this->getUserPage();
2194                 return $title->getTalkPage();
2195         }
2196
2197         /**
2198          * @static
2199          */
2200         function getMaxID() {
2201                 static $res; // cache
2202
2203                 if ( isset( $res ) )
2204                         return $res;
2205                 else {
2206                         $dbr = wfGetDB( DB_SLAVE );
2207                         return $res = $dbr->selectField( 'user', 'max(user_id)', false, 'User::getMaxID' );
2208                 }
2209         }
2210
2211         /**
2212          * Determine whether the user is a newbie. Newbies are either
2213          * anonymous IPs, or the most recently created accounts.
2214          * @return bool True if it is a newbie.
2215          */
2216         function isNewbie() {
2217                 return !$this->isAllowed( 'autoconfirmed' );
2218         }
2219
2220         /**
2221          * Check to see if the given clear-text password is one of the accepted passwords
2222          * @param string $password User password.
2223          * @return bool True if the given password is correct otherwise False.
2224          */
2225         function checkPassword( $password ) {
2226                 global $wgAuth;
2227                 $this->load();
2228
2229                 // Even though we stop people from creating passwords that
2230                 // are shorter than this, doesn't mean people wont be able
2231                 // to. Certain authentication plugins do NOT want to save
2232                 // domain passwords in a mysql database, so we should
2233                 // check this (incase $wgAuth->strict() is false).
2234                 if( !$this->isValidPassword( $password ) ) {
2235                         return false;
2236                 }
2237
2238                 if( $wgAuth->authenticate( $this->getName(), $password ) ) {
2239                         return true;
2240                 } elseif( $wgAuth->strict() ) {
2241                         /* Auth plugin doesn't allow local authentication */
2242                         return false;
2243                 }
2244                 $ep = $this->encryptPassword( $password );
2245                 if ( 0 == strcmp( $ep, $this->mPassword ) ) {
2246                         return true;
2247                 } elseif ( function_exists( 'iconv' ) ) {
2248                         # Some wikis were converted from ISO 8859-1 to UTF-8, the passwords can't be converted
2249                         # Check for this with iconv
2250                         $cp1252hash = $this->encryptPassword( iconv( 'UTF-8', 'WINDOWS-1252//TRANSLIT', $password ) );
2251                         if ( 0 == strcmp( $cp1252hash, $this->mPassword ) ) {
2252                                 return true;
2253                         }
2254                 }
2255                 return false;
2256         }
2257
2258         /**
2259          * Check if the given clear-text password matches the temporary password
2260          * sent by e-mail for password reset operations.
2261          * @return bool
2262          */
2263         function checkTemporaryPassword( $plaintext ) {
2264                 $hash = $this->encryptPassword( $plaintext );
2265                 return $hash === $this->mNewpassword;
2266         }
2267
2268         /**
2269          * Initialize (if necessary) and return a session token value
2270          * which can be used in edit forms to show that the user's
2271          * login credentials aren't being hijacked with a foreign form
2272          * submission.
2273          *
2274          * @param mixed $salt - Optional function-specific data for hash.
2275          *                      Use a string or an array of strings.
2276          * @return string
2277          * @public
2278          */
2279         function editToken( $salt = '' ) {
2280                 if ( $this->isAnon() ) {
2281                         return EDIT_TOKEN_SUFFIX;
2282                 } else {
2283                         if( !isset( $_SESSION['wsEditToken'] ) ) {
2284                                 $token = $this->generateToken();
2285                                 $_SESSION['wsEditToken'] = $token;
2286                         } else {
2287                                 $token = $_SESSION['wsEditToken'];
2288                         }
2289                         if( is_array( $salt ) ) {
2290                                 $salt = implode( '|', $salt );
2291                         }
2292                         return md5( $token . $salt ) . EDIT_TOKEN_SUFFIX;
2293                 }
2294         }
2295
2296         /**
2297          * Generate a hex-y looking random token for various uses.
2298          * Could be made more cryptographically sure if someone cares.
2299          * @return string
2300          */
2301         function generateToken( $salt = '' ) {
2302                 $token = dechex( mt_rand() ) . dechex( mt_rand() );
2303                 return md5( $token . $salt );
2304         }
2305
2306         /**
2307          * Check given value against the token value stored in the session.
2308          * A match should confirm that the form was submitted from the
2309          * user's own login session, not a form submission from a third-party
2310          * site.
2311          *
2312          * @param string $val - the input value to compare
2313          * @param string $salt - Optional function-specific data for hash
2314          * @return bool
2315          * @public
2316          */
2317         function matchEditToken( $val, $salt = '' ) {
2318                 $sessionToken = $this->editToken( $salt );
2319                 if ( $val != $sessionToken ) {
2320                         wfDebug( "User::matchEditToken: broken session data\n" );
2321                 }
2322                 return $val == $sessionToken;
2323         }
2324
2325         /**
2326          * Check whether the edit token is fine except for the suffix
2327          */
2328         function matchEditTokenNoSuffix( $val, $salt = '' ) {
2329                 $sessionToken = $this->editToken( $salt );
2330                 return substr( $sessionToken, 0, 32 ) == substr( $val, 0, 32 );
2331         }
2332
2333         /**
2334          * Generate a new e-mail confirmation token and send a confirmation
2335          * mail to the user's given address.
2336          *
2337          * @return mixed True on success, a WikiError object on failure.
2338          */
2339         function sendConfirmationMail() {
2340                 global $wgContLang;
2341                 $expiration = null; // gets passed-by-ref and defined in next line.
2342                 $url = $this->confirmationTokenUrl( $expiration );
2343                 return $this->sendMail( wfMsg( 'confirmemail_subject' ),
2344                         wfMsg( 'confirmemail_body',
2345                                 wfGetIP(),
2346                                 $this->getName(),
2347                                 $url,
2348                                 $wgContLang->timeanddate( $expiration, false ) ) );
2349         }
2350
2351         /**
2352          * Send an e-mail to this user's account. Does not check for
2353          * confirmed status or validity.
2354          *
2355          * @param string $subject
2356          * @param string $body
2357          * @param strong $from Optional from address; default $wgPasswordSender will be used otherwise.
2358          * @return mixed True on success, a WikiError object on failure.
2359          */
2360         function sendMail( $subject, $body, $from = null ) {
2361                 if( is_null( $from ) ) {
2362                         global $wgPasswordSender;
2363                         $from = $wgPasswordSender;
2364                 }
2365
2366                 require_once( 'UserMailer.php' );
2367                 $to = new MailAddress( $this );
2368                 $sender = new MailAddress( $from );
2369                 $error = userMailer( $to, $sender, $subject, $body );
2370
2371                 if( $error == '' ) {
2372                         return true;
2373                 } else {
2374                         return new WikiError( $error );
2375                 }
2376         }
2377
2378         /**
2379          * Generate, store, and return a new e-mail confirmation code.
2380          * A hash (unsalted since it's used as a key) is stored.
2381          * @param &$expiration mixed output: accepts the expiration time
2382          * @return string
2383          * @private
2384          */
2385         function confirmationToken( &$expiration ) {
2386                 $now = time();
2387                 $expires = $now + 7 * 24 * 60 * 60;
2388                 $expiration = wfTimestamp( TS_MW, $expires );
2389
2390                 $token = $this->generateToken( $this->mId . $this->mEmail . $expires );
2391                 $hash = md5( $token );
2392
2393                 $dbw = wfGetDB( DB_MASTER );
2394                 $dbw->update( 'user',
2395                         array( 'user_email_token'         => $hash,
2396                                'user_email_token_expires' => $dbw->timestamp( $expires ) ),
2397                         array( 'user_id'                  => $this->mId ),
2398                         __METHOD__ );
2399
2400                 return $token;
2401         }
2402
2403         /**
2404          * Generate and store a new e-mail confirmation token, and return
2405          * the URL the user can use to confirm.
2406          * @param &$expiration mixed output: accepts the expiration time
2407          * @return string
2408          * @private
2409          */
2410         function confirmationTokenUrl( &$expiration ) {
2411                 $token = $this->confirmationToken( $expiration );
2412                 $title = SpecialPage::getTitleFor( 'Confirmemail', $token );
2413                 return $title->getFullUrl();
2414         }
2415
2416         /**
2417          * Mark the e-mail address confirmed and save.
2418          */
2419         function confirmEmail() {
2420                 $this->load();
2421                 $this->mEmailAuthenticated = wfTimestampNow();
2422                 $this->saveSettings();
2423                 return true;
2424         }
2425
2426         /**
2427          * Is this user allowed to send e-mails within limits of current
2428          * site configuration?
2429          * @return bool
2430          */
2431         function canSendEmail() {
2432                 return $this->isEmailConfirmed();
2433         }
2434
2435         /**
2436          * Is this user allowed to receive e-mails within limits of current
2437          * site configuration?
2438          * @return bool
2439          */
2440         function canReceiveEmail() {
2441                 return $this->canSendEmail() && !$this->getOption( 'disablemail' );
2442         }
2443
2444         /**
2445          * Is this user's e-mail address valid-looking and confirmed within
2446          * limits of the current site configuration?
2447          *
2448          * If $wgEmailAuthentication is on, this may require the user to have
2449          * confirmed their address by returning a code or using a password
2450          * sent to the address from the wiki.
2451          *
2452          * @return bool
2453          */
2454         function isEmailConfirmed() {
2455                 global $wgEmailAuthentication;
2456                 $this->load();
2457                 $confirmed = true;
2458                 if( wfRunHooks( 'EmailConfirmed', array( &$this, &$confirmed ) ) ) {
2459                         if( $this->isAnon() )
2460                                 return false;
2461                         if( !self::isValidEmailAddr( $this->mEmail ) )
2462                                 return false;
2463                         if( $wgEmailAuthentication && !$this->getEmailAuthenticationTimestamp() )
2464                                 return false;
2465                         return true;
2466                 } else {
2467                         return $confirmed;
2468                 }
2469         }
2470
2471         /**
2472          * Return true if there is an outstanding request for e-mail confirmation.
2473          * @return bool
2474          */
2475         function isEmailConfirmationPending() {
2476                 global $wgEmailAuthentication;
2477                 return $wgEmailAuthentication &&
2478                         !$this->isEmailConfirmed() &&
2479                         $this->mEmailToken &&
2480                         $this->mEmailTokenExpires > wfTimestamp();
2481         }
2482
2483         /**
2484          * Get the timestamp of account creation, or false for
2485          * non-existent/anonymous user accounts
2486          *
2487          * @return mixed
2488          */
2489         public function getRegistration() {
2490                 return $this->mId > 0
2491                         ? $this->mRegistration
2492                         : false;
2493         }
2494
2495         /**
2496          * @param array $groups list of groups
2497          * @return array list of permission key names for given groups combined
2498          * @static
2499          */
2500         static function getGroupPermissions( $groups ) {
2501                 global $wgGroupPermissions;
2502                 $rights = array();
2503                 foreach( $groups as $group ) {
2504                         if( isset( $wgGroupPermissions[$group] ) ) {
2505                                 $rights = array_merge( $rights,
2506                                         array_keys( array_filter( $wgGroupPermissions[$group] ) ) );
2507                         }
2508                 }
2509                 return $rights;
2510         }
2511
2512         /**
2513          * @param string $group key name
2514          * @return string localized descriptive name for group, if provided
2515          * @static
2516          */
2517         static function getGroupName( $group ) {
2518                 MessageCache::loadAllMessages();
2519                 $key = "group-$group";
2520                 $name = wfMsg( $key );
2521                 return $name == '' || wfEmptyMsg( $key, $name )
2522                         ? $group
2523                         : $name;
2524         }
2525
2526         /**
2527          * @param string $group key name
2528          * @return string localized descriptive name for member of a group, if provided
2529          * @static
2530          */
2531         static function getGroupMember( $group ) {
2532                 MessageCache::loadAllMessages();
2533                 $key = "group-$group-member";
2534                 $name = wfMsg( $key );
2535                 return $name == '' || wfEmptyMsg( $key, $name )
2536                         ? $group
2537                         : $name;
2538         }
2539
2540         /**
2541          * Return the set of defined explicit groups.
2542          * The *, 'user', 'autoconfirmed' and 'emailconfirmed'
2543          * groups are not included, as they are defined
2544          * automatically, not in the database.
2545          * @return array
2546          * @static
2547          */
2548         static function getAllGroups() {
2549                 global $wgGroupPermissions;
2550                 return array_diff(
2551                         array_keys( $wgGroupPermissions ),
2552                         array( '*', 'user', 'autoconfirmed', 'emailconfirmed' ) );
2553         }
2554
2555         /**
2556          * Get the title of a page describing a particular group
2557          *
2558          * @param $group Name of the group
2559          * @return mixed
2560          */
2561         static function getGroupPage( $group ) {
2562                 MessageCache::loadAllMessages();
2563                 $page = wfMsgForContent( 'grouppage-' . $group );
2564                 if( !wfEmptyMsg( 'grouppage-' . $group, $page ) ) {
2565                         $title = Title::newFromText( $page );
2566                         if( is_object( $title ) )
2567                                 return $title;
2568                 }
2569                 return false;
2570         }
2571
2572         /**
2573          * Create a link to the group in HTML, if available
2574          *
2575          * @param $group Name of the group
2576          * @param $text The text of the link
2577          * @return mixed
2578          */
2579         static function makeGroupLinkHTML( $group, $text = '' ) {
2580                 if( $text == '' ) {
2581                         $text = self::getGroupName( $group );
2582                 }
2583                 $title = self::getGroupPage( $group );
2584                 if( $title ) {
2585                         global $wgUser;
2586                         $sk = $wgUser->getSkin();
2587                         return $sk->makeLinkObj( $title, htmlspecialchars( $text ) );
2588                 } else {
2589                         return $text;
2590                 }
2591         }
2592
2593         /**
2594          * Create a link to the group in Wikitext, if available
2595          *
2596          * @param $group Name of the group
2597          * @param $text The text of the link (by default, the name of the group)
2598          * @return mixed
2599          */
2600         static function makeGroupLinkWiki( $group, $text = '' ) {
2601                 if( $text == '' ) {
2602                         $text = self::getGroupName( $group );
2603                 }
2604                 $title = self::getGroupPage( $group );
2605                 if( $title ) {
2606                         $page = $title->getPrefixedText();
2607                         return "[[$page|$text]]";
2608                 } else {
2609                         return $text;
2610                 }
2611         }
2612
2613         /**
2614          * Increment the user's edit-count field.
2615          * Will have no effect for anonymous users.
2616          */
2617         function incEditCount() {
2618                 if( !$this->isAnon() ) {
2619                         $dbw = wfGetDB( DB_MASTER );
2620                         $dbw->update( 'user',
2621                                 array( 'user_editcount=user_editcount+1' ),
2622                                 array( 'user_id' => $this->getId() ),
2623                                 __METHOD__ );
2624
2625                         // Lazy initialization check...
2626                         if( $dbw->affectedRows() == 0 ) {
2627                                 // Pull from a slave to be less cruel to servers
2628                                 // Accuracy isn't the point anyway here
2629                                 $dbr = wfGetDB( DB_SLAVE );
2630                                 $count = $dbr->selectField( 'revision',
2631                                         'COUNT(rev_user)',
2632                                         array( 'rev_user' => $this->getId() ),
2633                                         __METHOD__ );
2634
2635                                 // Now here's a goddamn hack...
2636                                 if( $dbr !== $dbw ) {
2637                                         // If we actually have a slave server, the count is
2638                                         // at least one behind because the current transaction
2639                                         // has not been committed and replicated.
2640                                         $count++;
2641                                 } else {
2642                                         // But if DB_SLAVE is selecting the master, then the
2643                                         // count we just read includes the revision that was
2644                                         // just added in the working transaction.
2645                                 }
2646
2647                                 $dbw->update( 'user',
2648                                         array( 'user_editcount' => $count ),
2649                                         array( 'user_id' => $this->getId() ),
2650                                         __METHOD__ );
2651                         }
2652                 }
2653                 // edit count in user cache too
2654                 $this->invalidateCache();
2655         }
2656 }
2657
2658