account_model.php

<?php

class Accounts
{
    private $mysqli;
    private $redis;
    private $user;
    private $feed;
    private $table = "accounts";

    public function __construct($mysqli, $redis, $user, $feed)
    {
        $this->mysqli = $mysqli;
        $this->redis = $redis;
        $this->user = $user;
        $this->feed = $feed;
    }

    public function list($adminuser)
    {
        $adminuser = (int) $adminuser;

        $accounts = array();
        $result = $this->mysqli->query("SELECT linkeduser FROM ".$this->table." WHERE adminuser = '$adminuser' ORDER BY linkeduser ASC");
        while ($row = $result->fetch_object()) {

            // Get user details
            $result2 = $this->mysqli->query("SELECT * FROM users WHERE id='$row->linkeduser'");
            $u = $result2->fetch_object();

            // Count feeds
            $result2 = $this->mysqli->query("SELECT COUNT(*) AS feeds FROM feeds WHERE userid = '$row->linkeduser'");
            $f = $result2->fetch_object();
            
            $account = new stdClass();
            $account->id = $row->linkeduser*1;
            $account->username = $u->username;
            $account->location = $u->location;
            $account->email = $u->email;
            $account->feeds = $f->feeds*1;
            $account->access = $this->user->get_access($row->linkeduser);
            $account->apikey_read = $u->apikey_read;

            if (isset($u->activefeeds)) {
                $account->activefeeds = $u->activefeeds*1;
            } else {
                $account->activefeeds = 0;
            }

            if (isset($u->diskuse)) {
                $account->diskuse = $u->diskuse*1;
            } else {
                $account->diskuse = 0;
            }
            
            $accounts[] = $account;
        }
        return $accounts;
    }

    public function add($adminuser,$username,$password,$email,$timezone) 
    {
        // Check if adminuser is a linkeduser 
        $result = $this->mysqli->query("SELECT * FROM ".$this->table." WHERE linkeduser='$adminuser'");
        if ($result->fetch_object()) {
            return array("success"=>false,"message"=>"Cannot add user as admin user is a linked user");
        }

        $userid = $this->user->get_id($username);
        // If user does not exist then register
        if (!$userid) {
            // Get adminuser details, if email is the same turn off email verification
            $adminuser_details = $this->user->get($adminuser);
            if ($adminuser_details->email == $email) {
                $this->user->set_email_verification(false);
            }
            // User does not exist
            // Register user
            $result = $this->user->register($username, $password, $email, $timezone);
            if (!$result['success']) return $result;
            // if success then get userid
            $linkeduser = $result['userid'];
            
            // verify email
            $this->mysqli->query("UPDATE users SET email_verified='1' WHERE `id`='$linkeduser'");

            // Disable login access by default
            $this->user->set_access($linkeduser,2);
            
        } else {
            global $session;
            if (isset($_SESSION['admin']) && $_SESSION['admin']) {
                $linkeduser = $this->user->get_id($username);
            } else {
                // else check password and fetch userid
                $result = $this->user->get_apikeys_from_login($username,$password);
                if (!$result['success']) {
                    return array("success"=>false,"message"=>"invalid username or password");
                }
                $linkeduser = $result['userid'];
            }
        }

        // Check linked user is not admin user
        if ($adminuser==$linkeduser) {
            return array("success"=>false,"message"=>"cannot link to self");
        }
        
        // Check if user is already linked
        $result = $this->mysqli->query("SELECT * FROM ".$this->table." WHERE linkeduser='$linkeduser'");
        if ($row = $result->fetch_object()) {
            return array("success"=>false,"message"=>"user already linked");
        }
        
        // Add user to linked table
        $this->mysqli->query("INSERT INTO ".$this->table." (adminuser,linkeduser) VALUES ('$adminuser','$linkeduser')");
        
        return array("success"=>true,"message"=>"user linked");
    }

    // Change linked user password
    public function change_password($adminuser, $linkeduser, $password) {
        $adminuser = (int) $adminuser;
        $linkeduser = (int) $linkeduser;

        // Check if linkeduser belongs to adminuser
        if (!$this->is_linked($adminuser,$linkeduser)) {
            return array("success"=>false,"message"=>"invalid linked userid");
        }

        // Change password
        if (strlen($password) < 4 || strlen($password) > 250) return array('success'=>false, 'message'=>_("Password length error"));

        $hash = hash('sha256', $password);
        $salt = generate_secure_key(16);
        $password = hash('sha256', $salt . $hash);
        $stmt = $this->mysqli->prepare("UPDATE users SET password = ?, salt = ? WHERE id = ?");
        $stmt->bind_param("ssi", $password, $salt, $linkeduser);
        $stmt->execute();
        $stmt->close();
        
        return array("success"=>true,"message"=>"password updated");
    }

    // Change location
    public function change_location($adminuser, $linkeduser, $location)
    {
        $adminuser = (int) $adminuser;
        $linkeduser = (int) $linkeduser;
        $location = preg_replace('/[^\p{N}\p{L}_\s\-.]/u','',$location);

        // Check if linkeduser belongs to adminuser
        if (!$this->is_linked($adminuser,$linkeduser)) {
            return array("success"=>false,"message"=>"invalid linked userid");
        }

        // Edit user
        $stmt = $this->mysqli->prepare("UPDATE users SET location=? WHERE id=?");
        $stmt->bind_param("si", $location, $linkeduser);
        $stmt->execute();
        $stmt->close();
        return array("success"=>true,"message"=>"location updated");
    }

    // Change email
    public function change_email($adminuser, $linkeduser, $email)
    {
        $adminuser = (int) $adminuser;
        $linkeduser = (int) $linkeduser;
        $email = trim($email);

        // Check if linkeduser belongs to adminuser
        if (!$this->is_linked($adminuser,$linkeduser)) {
            return array("success"=>false,"message"=>"invalid linked userid");
        }

        // Check if email is valid
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            return array("success"=>false,"message"=>"invalid email");
        }

        // Edit user
        $stmt = $this->mysqli->prepare("UPDATE users SET email=? WHERE id=?");
        $stmt->bind_param("si", $email, $linkeduser);
        $stmt->execute();
        $stmt->close();
        return array("success"=>true,"message"=>"email updated");
    }
    
    public function unlink($adminuser,$linkeduser)
    {
        $adminuser = (int) $adminuser;
        $linkeduser = (int) $linkeduser;

        // Check if linkeduser belongs to adminuser
        if (!$this->is_linked($adminuser,$linkeduser)) {
            return array("success"=>false,"message"=>"invalid linked userid");
        }

        // Unlink user
        $this->mysqli->query("DELETE FROM ".$this->table." WHERE adminuser='$adminuser' AND linkeduser='$linkeduser'");
        return array("success"=>true,"message"=>"user unlinked");
    }

    public function switch($adminuser, $linkeduser) {
        $adminuser = (int) $adminuser;
        $linkeduser = (int) $linkeduser;

        // switch to adminuser
        if (!$linkeduser && isset($_SESSION["adminuser"])) {
            $userid = $_SESSION["adminuser"];
            unset($_SESSION["adminuser"]);
            $this->load_user_session($userid);

            header("Location: ../account/list");
            // stop any other code from running once http header sent
            exit();
        }

        // check that linkeduser is linked to adminuser
        if (!$this->is_linked($adminuser,$linkeduser)) {
            return array("success"=>false,"message"=>"invalid linked userid");
        }

        // switch user
        $_SESSION["adminuser"] = $adminuser;
        $this->load_user_session($linkeduser);
        
        header("Location: ../".$_SESSION["startingpage"]);
        // stop any other code from running once http header sent
        exit();
    }

    public function load_user_session($userid) {
        $userid = (int) $userid;
        $result = $this->mysqli->query("SELECT `username`,`admin`,`timezone`,`startingpage`,`gravatar` FROM users WHERE `id`='$userid'");
        if ($row = $result->fetch_object()) {
            $_SESSION["userid"] = $userid;
            $_SESSION['admin'] = $row->admin;
            $_SESSION["username"] = $row->username;
            $_SESSION["timezone"] = $row->timezone;
            $_SESSION["startingpage"] = $row->startingpage;
            $_SESSION["gravatar"] = $row->gravatar;
        }
    }

    // Set access
    public function set_access($adminuser,$linkeduser,$access) {
        $adminuser = (int) $adminuser;
        $linkeduser = (int) $linkeduser;
        $access = (int) $access;

        // Check if linkeduser belongs to adminuser
        if (!$this->is_linked($adminuser,$linkeduser)) {
            return array("success"=>false,"message"=>"invalid linked userid");
        }

        // Set access
        $this->user->set_access($linkeduser,$access);

        return array("success"=>true,"message"=>"access updated");
    }

    // Check if linkeduser belongs to adminuser
    public function is_linked($adminuser,$linkeduser) {
        $adminuser = (int) $adminuser;
        $linkeduser = (int) $linkeduser;
        $result = $this->mysqli->query("SELECT * FROM ".$this->table." WHERE adminuser='$adminuser' AND linkeduser='$linkeduser'");
        if ($result->fetch_object()) {
            return true;
        }
        return false;
    }
    
    // Delete user method
    public function delete_user($userid, $dryrun = true) {
        $userid = (int) $userid;

        // Check if user is a linked user
        $result = $this->mysqli->query("SELECT * FROM ".$this->table." WHERE linkeduser='$userid'");
        if ($result->fetch_object()) {
            if (!$dryrun) {
                // Unlink user
                $this->mysqli->query("DELETE FROM ".$this->table." WHERE linkeduser='$userid'");
            }
            return array("success"=>true,"message"=>"removed user from accounts table");
        }

        // Check if user is an admin user
        $result = $this->mysqli->query("SELECT * FROM ".$this->table." WHERE adminuser='$userid'");
        // If user is an admin user then delete all linked users
        // get number of linked users
        $num_linked_users = $result->num_rows;
        if ($num_linked_users) {
            if (!$dryrun) {
                // Delete all linked users
                $this->mysqli->query("DELETE FROM ".$this->table." WHERE adminuser='$userid'");
            }
            return array("success"=>true,"message"=>"removed $num_linked_users linked users from accounts table");
        }
        
        // no linked or admin users
        return array("success"=>false,"message"=>"user not found in accounts table");
    }

    // Refresh account stats, disk use and active feeds
    public function refresh_account_stats($adminuser) {
        $adminuser = (int) $adminuser;

        $result = $this->mysqli->query("SELECT linkeduser FROM ".$this->table." WHERE adminuser = '$adminuser' ORDER BY linkeduser ASC");
        while ($row = $result->fetch_object()) {
            $this->feed->update_user_feeds_size($row->linkeduser);
            $this->count_active_feeds($row->linkeduser);
        }
    }

    public function count_active_feeds($userid) {
        $userid = (int) $userid;

        $activefeeds = 0;
        $now = time();

        $result = $this->mysqli->query("SELECT id FROM feeds WHERE userid = '$userid'");
        while ($row = $result->fetch_object()) {
            $feedid = $row->id;
            $time = $this->redis->hget("feed:$feedid","time");
            if ($time!=null) {
                if (($now-$time)<(3600*3)) {
                    $activefeeds++;
                }
            }
        }
        
        // Check if activefeeds column exists before updating
        $result = $this->mysqli->query("SHOW COLUMNS FROM users LIKE 'activefeeds'");
        if ($result->num_rows > 0) {
            $this->mysqli->query("UPDATE users SET `activefeeds` = '$activefeeds' WHERE `id`= '$userid'");
            return true;
        } else {
            return false;
        }
    }
}