Users::getUnarchivedCount() - Code Metrics - Inspection of "make sure we cannot unarchive a user if another ac..." - elabftw/elabftw - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — hypernext ( bcec6c...a39b39 )

by Nico

created 2021-08-27 15:44 UTC

Users::getUnarchivedCount() A

↳ Parent: Users

Complexity

Conditions	1
Paths	1

Size

Total Lines	7
Code Lines	5

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	2
CRAP Score	1.037

Importance

Changes

Metric	Value
cc	1
eloc	5
nc	1
nop	0
dl	0
loc	7
ccs	2
cts	3
cp	0.6667
crap	1.037
rs	10
c	0
b	0
f	0

<?php
/**
 * @author Nicolas CARPi <[email protected]>
 * @copyright 2012 Nicolas CARPi
 * @see https://www.elabftw.net Official website
 * @license AGPL-3.0
 * @package elabftw
 */
declare(strict_types=1);

namespace Elabftw\Models;

use Elabftw\Elabftw\Db;
use Elabftw\Exceptions\ImproperActionException;
use Elabftw\Exceptions\ResourceNotFoundException;
use Elabftw\Interfaces\ContentParamsInterface;
use Elabftw\Services\Check;
use Elabftw\Services\Email;
use Elabftw\Services\EmailValidator;
use Elabftw\Services\Filter;
use Elabftw\Services\TeamsHelper;
use Elabftw\Services\UsersHelper;
use function filter_var;
use function hash;
use function mb_strlen;
use function password_hash;
use PDO;
use function time;

/**
 * Users
 */
class Users
{
    public bool $needValidation = false;

    public array $userData = array();

    public int $team = 0;

    protected Db $Db;

    public function __construct(?int $userid = null, ?int $team = null)
    {
        $this->Db = Db::getConnection();
        if ($team !== null) {
            $this->team = $team;
        }
        if ($userid !== null) {
            $this->populate($userid);
        }
    }

    /**
     * Populate userData property
     */
    public function populate(int $userid): void
    {
        Check::idOrExplode($userid);
        $this->userData = $this->getUserData($userid);
        $this->userData['team'] = $this->team;
    }

    /**
     * Create a new user
     */
    public function create(
        string $email,
        array $teams,
        string $firstname = '',
        string $lastname = '',
        string $password = '',
        ?int $group = null,
        bool $forceValidation = false,
        bool $alertAdmin = true,
    ): int {
        $Config = Config::getConfig();
        $Teams = new Teams($this);

        // make sure that all the teams in which the user will be are created/exist
        // this might throw an exception if the team doesn't exist and we can't create it on the fly
        $teams = $Teams->getTeamsFromIdOrNameOrOrgidArray($teams);

        $EmailValidator = new EmailValidator($email, $Config->configArr['email_domain']);
        $EmailValidator->validate();

        if ($password !== '') {
            Check::passwordLength($password);
        }

        $firstname = filter_var($firstname, FILTER_SANITIZE_STRING);
        $lastname = filter_var($lastname, FILTER_SANITIZE_STRING);

        // Create password hash
        $passwordHash = password_hash($password, PASSWORD_DEFAULT);

        // Registration date is stored in epoch
        $registerDate = time();

        // get the group for the new user
        if ($group === null) {
            $teamId = (int) $teams[0]['id'];
            $TeamsHelper = new TeamsHelper($teamId);
            $group = $TeamsHelper->getGroup();
        }

        // will new user be validated?
        $validated = $Config->configArr['admin_validate'] && ($group === 4) ? 0 : 1;
        if ($forceValidation) {
            $validated = 1;
        }


        $sql = 'INSERT INTO users (
            `email`,
            `password_hash`,
            `firstname`,
            `lastname`,
            `usergroup`,
            `register_date`,
            `validated`,
            `lang`
        ) VALUES (
            :email,
            :password_hash,
            :firstname,
            :lastname,
            :usergroup,
            :register_date,
            :validated,
            :lang);';
        $req = $this->Db->prepare($sql);

        $req->bindParam(':email', $email);
        $req->bindParam(':password_hash', $passwordHash);
        $req->bindParam(':firstname', $firstname);
        $req->bindParam(':lastname', $lastname);
        $req->bindParam(':register_date', $registerDate);
        $req->bindParam(':validated', $validated, PDO::PARAM_INT);
        $req->bindParam(':usergroup', $group, PDO::PARAM_INT);
        $req->bindValue(':lang', $Config->configArr['lang']);
        $this->Db->execute($req);
        $userid = $this->Db->lastInsertId();

        // now add the user to the team
        $Teams->addUserToTeams($userid, array_column($teams, 'id'));
        $userInfo = array('email' => $email, 'name' => $firstname . ' ' . $lastname);
        $Email = new Email($Config, $this);
        // just skip this if we don't have proper normalized teams
        if ($alertAdmin && isset($teams[0]['id'])) {
            $Email->alertAdmin((int) $teams[0]['id'], $userInfo, !(bool) $validated);
        }
        if ($validated === 0) {
            $Email->alertUserNeedValidation($email);
            // set a flag to show correct message to user
            $this->needValidation = true;
        }
        return $userid;
    }

    /**
     * Get users matching a search term for consumption in autocomplete
     */
    public function read(ContentParamsInterface $params): array
    {
        $usersArr = $this->readFromQuery($params->getContent());
        $res = array();
        foreach ($usersArr as $user) {
            $res[] = $user['userid'] . ' - ' . $user['fullname'];
        }
        return $res;
    }

    /**
     * Search users based on query. It searches in email, firstname, lastname or team name
     *
     * @param string $query the searched term
     * @param bool $teamFilter toggle between sysadmin/admin view
     */
    public function readFromQuery(string $query, bool $teamFilter = false): array
    {
        $teamFilterSql = '';
        if ($teamFilter) {
            $teamFilterSql = 'AND users2teams.teams_id = :team';
        }

        // NOTE: previously, the ORDER BY started with the team, but that didn't work
        // with the DISTINCT, so it was removed.
        $sql = "SELECT DISTINCT users.userid,
            users.firstname, users.lastname, users.email, users.mfa_secret,
            users.validated, users.usergroup, users.archived, users.last_login,
            CONCAT(users.firstname, ' ', users.lastname) AS fullname,
            users.cellphone, users.phone, users.website, users.skype
            FROM users
            CROSS JOIN users2teams ON (users2teams.users_id = users.userid " . $teamFilterSql . ')
            WHERE (users.email LIKE :query OR users.firstname LIKE :query OR users.lastname LIKE :query)
            ORDER BY users.usergroup ASC, users.lastname ASC';
        $req = $this->Db->prepare($sql);
        $req->bindValue(':query', '%' . $query . '%');
        if ($teamFilter) {
            $req->bindValue(':team', $this->userData['team']);
        }
        $this->Db->execute($req);

        return $this->Db->fetchAll($req);
    }

    /**
     * Read all users from the team
     */
    public function readAllFromTeam(): array
    {
        return $this->readFromQuery('', true);
    }

    public function getLockedUsersCount(): int
    {
        $sql = 'SELECT COUNT(userid) FROM users WHERE allow_untrusted = 0';
        $req = $this->Db->prepare($sql);
        $this->Db->execute($req);
        return (int) $req->fetchColumn();
    }

    /**
     * Update user from the editusers template
     *
     * @param array<string, mixed> $params POST
     */
    public function update(array $params): bool
    {
        $this->checkEmail($params['email']);

        $firstname = Filter::sanitize($params['firstname']);
        $lastname = Filter::sanitize($params['lastname']);

        // (Sys)admins can only disable 2FA
        // input is disabled if there is no mfa active so no need for an else case
        $mfaSql = '';
        if ($params['use_mfa'] === 'off') {
            $mfaSql = ', mfa_secret = null';
        }

        $validated = 0;
        if ($params['validated'] === '1') {
            $validated = 1;
        }

        $usergroup = Check::id((int) $params['usergroup']);

        if (mb_strlen($params['password']) > 1) {
            $this->updatePassword($params['password']);
        }

        $sql = 'UPDATE users SET
            firstname = :firstname,
            lastname = :lastname,
            email = :email,
            usergroup = :usergroup,
            validated = :validated';
        $sql .= $mfaSql;
        $sql .= ' WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':firstname', $firstname);
        $req->bindParam(':lastname', $lastname);
        $req->bindParam(':email', $params['email']);
        $req->bindParam(':usergroup', $usergroup);
        $req->bindParam(':validated', $validated);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    /**
     * Update things from UCP
     *
     * @param array<string, mixed> $params
     */
    public function updateAccount(array $params): bool
    {
        $this->checkEmail($params['email']);

        $params['firstname'] = Filter::sanitize($params['firstname']);
        $params['lastname'] = Filter::sanitize($params['lastname']);

        // Check phone
        $params['phone'] = filter_var($params['phone'], FILTER_SANITIZE_STRING);
        // Check cellphone
        $params['cellphone'] = filter_var($params['cellphone'], FILTER_SANITIZE_STRING);
        // Check skype
        $params['skype'] = filter_var($params['skype'], FILTER_SANITIZE_STRING);

        // Check website
        $params['website'] = filter_var($params['website'], FILTER_VALIDATE_URL);

        $sql = 'UPDATE users SET
            email = :email,
            firstname = :firstname,
            lastname = :lastname,
            phone = :phone,
            cellphone = :cellphone,
            skype = :skype,
            website = :website
            WHERE userid = :userid';
        $req = $this->Db->prepare($sql);

        $req->bindParam(':email', $params['email']);
        $req->bindParam(':firstname', $params['firstname']);
        $req->bindParam(':lastname', $params['lastname']);
        $req->bindParam(':phone', $params['phone']);
        $req->bindParam(':cellphone', $params['cellphone']);
        $req->bindParam(':skype', $params['skype']);
        $req->bindParam(':website', $params['website']);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    /**
     * Update the password for the user
     */
    public function updatePassword(string $password): bool
    {
        Check::passwordLength($password);

        $passwordHash = password_hash($password, PASSWORD_DEFAULT);

        $sql = 'UPDATE users SET password_hash = :password_hash, token = null WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':password_hash', $passwordHash);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    /**
     * Invalidate token on logout action
     */
    public function invalidateToken(): bool
    {
        $sql = 'UPDATE users SET token = null WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    /**
     * Validate current user instance
     */
    public function validate(): bool
    {
        $sql = 'UPDATE users SET validated = 1 WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    /**
     * Archive/Unarchive a user
     */
    public function toggleArchive(): bool
    {
        if ($this->userData['archived']) {
            if ($this->getUnarchivedCount() > 0) {
                throw new ImproperActionException('Cannot unarchive this user because they have another active account with the same email!');
            }
        }

        $sql = 'UPDATE users SET archived = IF(archived = 1, 0, 1), token = null WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    /**
     * Lock all the experiments owned by user
     */
    public function lockExperiments(): bool
    {
        $sql = 'UPDATE experiments
            SET locked = :locked, lockedby = :userid, lockedwhen = CURRENT_TIMESTAMP WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindValue(':locked', 1);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    public function allowUntrustedLogin(): bool
    {
        $sql = 'SELECT allow_untrusted, auth_lock_time > (NOW() - INTERVAL 1 HOUR) AS currently_locked FROM users WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        $req->execute();
        $res = $req->fetch();

        if ($res['allow_untrusted'] === '1') {
            return true;
        }
        // check for the time when it was locked
        return $res['currently_locked'] === '0';
    }

    /**
     * Destroy user. Will completely remove everything from the user.
     */
    public function destroy(): bool
    {
        $UsersHelper = new UsersHelper((int) $this->userData['userid']);
        if ($UsersHelper->hasExperiments()) {
            throw new ImproperActionException('Cannot delete a user that owns experiments!');
        }
        $sql = 'DELETE FROM users WHERE userid = :userid';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
        return $this->Db->execute($req);
    }

    // if the user is already archived, make sure there is no other account with the same email
    private function getUnarchivedCount(): int
    {
        $sql = 'SELECT COUNT(email) FROM users WHERE email = :email AND archived = 0';
        $req = $this->Db->prepare($sql);
        $req->bindParam(':email', $this->userData['email']);
        $this->Db->execute($req);
        return (int) $req->fetchColumn();
    }

    /**
     * Get info about a user
     */
    private function getUserData(int $userid): array
    {
        $sql = "SELECT users.*, CONCAT(users.firstname, ' ', users.lastname) AS fullname,
            groups.can_lock, groups.is_admin, groups.is_sysadmin FROM users
            LEFT JOIN `groups` ON groups.id = users.usergroup
            WHERE users.userid = :userid";
        $req = $this->Db->prepare($sql);
        $req->bindParam(':userid', $userid, PDO::PARAM_INT);
        $this->Db->execute($req);
        $res = $req->fetch();
        if ($res === false) {
            throw new ResourceNotFoundException();
        }

        return $res;
    }

    private function checkEmail(string $email): void
    {
        // do nothing if the email sent is the same as the existing one
        if ($email === $this->userData['email']) {
            return;
        }
        // if the sent email is different from the existing one, check it's valid (not duplicate and respects domain constraint)
        $Config = Config::getConfig();
        $EmailValidator = new EmailValidator($email, $Config->configArr['email_domain']);
        $EmailValidator->validate();
    }
}


1		<?php
2		/**
3		* @author Nicolas CARPi <[email protected]>
4		* @copyright 2012 Nicolas CARPi
5		* @see https://www.elabftw.net Official website
6		* @license AGPL-3.0
7		* @package elabftw
8		*/
9		declare(strict_types=1);
10
11		namespace Elabftw\Models;
12
13		use Elabftw\Elabftw\Db;
14		use Elabftw\Exceptions\ImproperActionException;
15		use Elabftw\Exceptions\ResourceNotFoundException;
16		use Elabftw\Interfaces\ContentParamsInterface;
17		use Elabftw\Services\Check;
18		use Elabftw\Services\Email;
19		use Elabftw\Services\EmailValidator;
20		use Elabftw\Services\Filter;
21		use Elabftw\Services\TeamsHelper;
22		use Elabftw\Services\UsersHelper;
23		use function filter_var;
24		use function hash;
25		use function mb_strlen;
26		use function password_hash;
27		use PDO;
28		use function time;
29
30		/**
31		* Users
32		*/
33		class Users
34		{
35		public bool $needValidation = false;
36
37		public array $userData = array();
38
39		public int $team = 0;
40
41		protected Db $Db;
42
43	83	public function __construct(?int $userid = null, ?int $team = null)
44		{
45	83	$this->Db = Db::getConnection();
46	83	if ($team !== null) {
47	83	$this->team = $team;
48		}
49	83	if ($userid !== null) {
50		$this->populate($userid);
51		}
52		}
53
54		/**
55		* Populate userData property
56	83	*/
57		public function populate(int $userid): void
58	83	{
59	83	Check::idOrExplode($userid);
60	83	$this->userData = $this->getUserData($userid);
61		$this->userData['team'] = $this->team;
62		}
63
64		/**
65		* Create a new user
66		*/
67		public function create(
68		string $email,
69		array $teams,
70		string $firstname = '',
71		string $lastname = '',
72		string $password = '',
73		?int $group = null,
74		bool $forceValidation = false,
75		bool $alertAdmin = true,
76		): int {
77		$Config = Config::getConfig();
78		$Teams = new Teams($this);
79
80		// make sure that all the teams in which the user will be are created/exist
81		// this might throw an exception if the team doesn't exist and we can't create it on the fly
82		$teams = $Teams->getTeamsFromIdOrNameOrOrgidArray($teams);
83
84		$EmailValidator = new EmailValidator($email, $Config->configArr['email_domain']);
85		$EmailValidator->validate();
86
87		if ($password !== '') {
88		Check::passwordLength($password);
89		}
90
91		$firstname = filter_var($firstname, FILTER_SANITIZE_STRING);
92		$lastname = filter_var($lastname, FILTER_SANITIZE_STRING);
93
94		// Create password hash
95		$passwordHash = password_hash($password, PASSWORD_DEFAULT);
96
97		// Registration date is stored in epoch
98		$registerDate = time();
99
100		// get the group for the new user
101		if ($group === null) {
102		$teamId = (int) $teams[0]['id'];
103		$TeamsHelper = new TeamsHelper($teamId);
104		$group = $TeamsHelper->getGroup();
105		}
106
107		// will new user be validated?
108		$validated = $Config->configArr['admin_validate'] && ($group === 4) ? 0 : 1;
109		if ($forceValidation) {
110		$validated = 1;
111		}
112
113
114		$sql = 'INSERT INTO users (
115		`email`,
116		`password_hash`,
117		`firstname`,
118		`lastname`,
119		`usergroup`,
120		`register_date`,
121		`validated`,
122		`lang`
123		) VALUES (
124		:email,
125		:password_hash,
126		:firstname,
127		:lastname,
128		:usergroup,
129		:register_date,
130		:validated,
131		:lang);';
132		$req = $this->Db->prepare($sql);
133
134		$req->bindParam(':email', $email);
135		$req->bindParam(':password_hash', $passwordHash);
136		$req->bindParam(':firstname', $firstname);
137		$req->bindParam(':lastname', $lastname);
138		$req->bindParam(':register_date', $registerDate);
139		$req->bindParam(':validated', $validated, PDO::PARAM_INT);
140		$req->bindParam(':usergroup', $group, PDO::PARAM_INT);
141		$req->bindValue(':lang', $Config->configArr['lang']);
142		$this->Db->execute($req);
143		$userid = $this->Db->lastInsertId();
144
145		// now add the user to the team
146		$Teams->addUserToTeams($userid, array_column($teams, 'id'));
147		$userInfo = array('email' => $email, 'name' => $firstname . ' ' . $lastname);
148		$Email = new Email($Config, $this);
149		// just skip this if we don't have proper normalized teams
150		if ($alertAdmin && isset($teams[0]['id'])) {
151		$Email->alertAdmin((int) $teams[0]['id'], $userInfo, !(bool) $validated);
152		}
153		if ($validated === 0) {
154		$Email->alertUserNeedValidation($email);
155		// set a flag to show correct message to user
156		$this->needValidation = true;
157		}
158		return $userid;
159		}
160
161		/**
162		* Get users matching a search term for consumption in autocomplete
163		*/
164		public function read(ContentParamsInterface $params): array
165		{
166		$usersArr = $this->readFromQuery($params->getContent());
167		$res = array();
168		foreach ($usersArr as $user) {
169		$res[] = $user['userid'] . ' - ' . $user['fullname'];
170		}
171		return $res;
172		}
173
174		/**
175		* Search users based on query. It searches in email, firstname, lastname or team name
176		*
177		* @param string $query the searched term
178		* @param bool $teamFilter toggle between sysadmin/admin view
179		*/
180	83	public function readFromQuery(string $query, bool $teamFilter = false): array
181		{
182	83	$teamFilterSql = '';
183		if ($teamFilter) {
184		$teamFilterSql = 'AND users2teams.teams_id = :team';
185		}
186	83
187	83	// NOTE: previously, the ORDER BY started with the team, but that didn't work
188	83	// with the DISTINCT, so it was removed.
189		$sql = "SELECT DISTINCT users.userid,
190		users.firstname, users.lastname, users.email, users.mfa_secret,
191	83	users.validated, users.usergroup, users.archived, users.last_login,
192	83	CONCAT(users.firstname, ' ', users.lastname) AS fullname,
193		users.cellphone, users.phone, users.website, users.skype
194		FROM users
195		CROSS JOIN users2teams ON (users2teams.users_id = users.userid " . $teamFilterSql . ')
196	83	WHERE (users.email LIKE :query OR users.firstname LIKE :query OR users.lastname LIKE :query)
197		ORDER BY users.usergroup ASC, users.lastname ASC';
198		$req = $this->Db->prepare($sql);
199		$req->bindValue(':query', '%' . $query . '%');
200		if ($teamFilter) {
201		$req->bindValue(':team', $this->userData['team']);
202		}
203		$this->Db->execute($req);
204
205		return $this->Db->fetchAll($req);
206		}
207
208		/**
209		* Read all users from the team
210		*/
211		public function readAllFromTeam(): array
212		{
213		return $this->readFromQuery('', true);
214		}
215
216		public function getLockedUsersCount(): int
217		{
218		$sql = 'SELECT COUNT(userid) FROM users WHERE allow_untrusted = 0';
219		$req = $this->Db->prepare($sql);
220		$this->Db->execute($req);
221		return (int) $req->fetchColumn();
222		}
223
224		/**
225		* Update user from the editusers template
226		*
227		* @param array<string, mixed> $params POST
228		*/
229		public function update(array $params): bool
230		{
231		$this->checkEmail($params['email']);
232
233		$firstname = Filter::sanitize($params['firstname']);
234		$lastname = Filter::sanitize($params['lastname']);
235
236		// (Sys)admins can only disable 2FA
237		// input is disabled if there is no mfa active so no need for an else case
238		$mfaSql = '';
239		if ($params['use_mfa'] === 'off') {
240		$mfaSql = ', mfa_secret = null';
241		}
242
243		$validated = 0;
244		if ($params['validated'] === '1') {
245		$validated = 1;
246		}
247
248		$usergroup = Check::id((int) $params['usergroup']);
249
250		if (mb_strlen($params['password']) > 1) {
251		$this->updatePassword($params['password']);
252		}
253
254		$sql = 'UPDATE users SET
255		firstname = :firstname,
256		lastname = :lastname,
257		email = :email,
258		usergroup = :usergroup,
259		validated = :validated';
260		$sql .= $mfaSql;
261		$sql .= ' WHERE userid = :userid';
262		$req = $this->Db->prepare($sql);
263		$req->bindParam(':firstname', $firstname);
264		$req->bindParam(':lastname', $lastname);
265		$req->bindParam(':email', $params['email']);
266		$req->bindParam(':usergroup', $usergroup);
267		$req->bindParam(':validated', $validated);
268		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
269		return $this->Db->execute($req);
270		}
271
272		/**
273		* Update things from UCP
274		*
275		* @param array<string, mixed> $params
276		*/
277		public function updateAccount(array $params): bool
278		{
279		$this->checkEmail($params['email']);
280
281		$params['firstname'] = Filter::sanitize($params['firstname']);
282		$params['lastname'] = Filter::sanitize($params['lastname']);
283
284		// Check phone
285		$params['phone'] = filter_var($params['phone'], FILTER_SANITIZE_STRING);
286		// Check cellphone
287		$params['cellphone'] = filter_var($params['cellphone'], FILTER_SANITIZE_STRING);
288		// Check skype
289		$params['skype'] = filter_var($params['skype'], FILTER_SANITIZE_STRING);
290
291		// Check website
292		$params['website'] = filter_var($params['website'], FILTER_VALIDATE_URL);
293
294		$sql = 'UPDATE users SET
295		email = :email,
296		firstname = :firstname,
297		lastname = :lastname,
298		phone = :phone,
299		cellphone = :cellphone,
300		skype = :skype,
301		website = :website
302		WHERE userid = :userid';
303		$req = $this->Db->prepare($sql);
304
305		$req->bindParam(':email', $params['email']);
306		$req->bindParam(':firstname', $params['firstname']);
307		$req->bindParam(':lastname', $params['lastname']);
308		$req->bindParam(':phone', $params['phone']);
309		$req->bindParam(':cellphone', $params['cellphone']);
310		$req->bindParam(':skype', $params['skype']);
311		$req->bindParam(':website', $params['website']);
312		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
313		return $this->Db->execute($req);
314		}
315
316		/**
317		* Update the password for the user
318		*/
319		public function updatePassword(string $password): bool
320		{
321		Check::passwordLength($password);
322
323		$passwordHash = password_hash($password, PASSWORD_DEFAULT);
324
325		$sql = 'UPDATE users SET password_hash = :password_hash, token = null WHERE userid = :userid';
326		$req = $this->Db->prepare($sql);
327		$req->bindParam(':password_hash', $passwordHash);
328		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
329		return $this->Db->execute($req);
330		}
331
332		/**
333		* Invalidate token on logout action
334		*/
335		public function invalidateToken(): bool
336		{
337		$sql = 'UPDATE users SET token = null WHERE userid = :userid';
338		$req = $this->Db->prepare($sql);
339		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
340		return $this->Db->execute($req);
341		}
342
343		/**
344		* Validate current user instance
345		*/
346		public function validate(): bool
347		{
348		$sql = 'UPDATE users SET validated = 1 WHERE userid = :userid';
349		$req = $this->Db->prepare($sql);
350		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
351		return $this->Db->execute($req);
352		}
353
354		/**
355		* Archive/Unarchive a user
356		*/
357		public function toggleArchive(): bool
358		{
359		if ($this->userData['archived']) {
360		if ($this->getUnarchivedCount() > 0) {
361		throw new ImproperActionException('Cannot unarchive this user because they have another active account with the same email!');
362		}
363		}
364
365		$sql = 'UPDATE users SET archived = IF(archived = 1, 0, 1), token = null WHERE userid = :userid';
366		$req = $this->Db->prepare($sql);
367		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
368		return $this->Db->execute($req);
369		}
370
371		/**
372		* Lock all the experiments owned by user
373		*/
374		public function lockExperiments(): bool
375		{
376		$sql = 'UPDATE experiments
377		SET locked = :locked, lockedby = :userid, lockedwhen = CURRENT_TIMESTAMP WHERE userid = :userid';
378		$req = $this->Db->prepare($sql);
379		$req->bindValue(':locked', 1);
380		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
381		return $this->Db->execute($req);
382		}
383
384		public function allowUntrustedLogin(): bool
385		{
386		$sql = 'SELECT allow_untrusted, auth_lock_time > (NOW() - INTERVAL 1 HOUR) AS currently_locked FROM users WHERE userid = :userid';
387		$req = $this->Db->prepare($sql);
388		$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
389		$req->execute();
390		$res = $req->fetch();
391
392		if ($res['allow_untrusted'] === '1') {
393		return true;
394		}
395		// check for the time when it was locked
396		return $res['currently_locked'] === '0';
397		}
398
399		/**
400		* Destroy user. Will completely remove everything from the user.
401		*/
402		public function destroy(): bool
403		{
404	1	$UsersHelper = new UsersHelper((int) $this->userData['userid']);
405		if ($UsersHelper->hasExperiments()) {
406		throw new ImproperActionException('Cannot delete a user that owns experiments!');
407	1	}
408		$sql = 'DELETE FROM users WHERE userid = :userid';
409		$req = $this->Db->prepare($sql);
410	1	$req->bindParam(':userid', $this->userData['userid'], PDO::PARAM_INT);
411	1	return $this->Db->execute($req);
412	1	}
413
414		// if the user is already archived, make sure there is no other account with the same email
415		private function getUnarchivedCount(): int
416		{
417	1	$sql = 'SELECT COUNT(email) FROM users WHERE email = :email AND archived = 0';
418	1	$req = $this->Db->prepare($sql);
419		$req->bindParam(':email', $this->userData['email']);
420		$this->Db->execute($req);
421		return (int) $req->fetchColumn();
422		}
423	1
424		/**
425		* Get info about a user
426		*/
427	1	private function getUserData(int $userid): array
428	1	{
429		$sql = "SELECT users.*, CONCAT(users.firstname, ' ', users.lastname) AS fullname,
430		groups.can_lock, groups.is_admin, groups.is_sysadmin FROM users
431	1	LEFT JOIN `groups` ON groups.id = users.usergroup
432	1	WHERE users.userid = :userid";
433		$req = $this->Db->prepare($sql);
434		$req->bindParam(':userid', $userid, PDO::PARAM_INT);
435	1	$this->Db->execute($req);
436	1	$res = $req->fetch();
437		if ($res === false) {
438		throw new ResourceNotFoundException();
439	1	}
440	1
441		return $res;
442		}
443
444		private function checkEmail(string $email): void
445	1	{
446		// do nothing if the email sent is the same as the existing one
447	1	if ($email === $this->userData['email']) {
448		return;
449	1	}
450		// if the sent email is different from the existing one, check it's valid (not duplicate and respects domain constraint)
451	1	$Config = Config::getConfig();
452		$EmailValidator = new EmailValidator($email, $Config->configArr['email_domain']);
453	1	$EmailValidator->validate();
454	1	}
455		}
456

elabftw / elabftw

Push — hypernext ( bcec6c...a39b39 )

Users::getUnarchivedCount() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like