includes/api/ApiCreateAccount.php

   1 <?php
   2 /**
   3  * Created on August 7, 2012
   4  *
   5  * Copyright © 2012 Tyler Romeo <tylerromeo@gmail.com>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, write to the Free Software Foundation, Inc.,
  19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  20  * http://www.gnu.org/copyleft/gpl.html
  21  *
  22  * @file
  23  */
  24
  25 /**
  26  * Unit to authenticate account registration attempts to the current wiki.
  27  *
  28  * @ingroup API
  29  */
  30 class ApiCreateAccount extends ApiBase {
  31         public function execute() {
  32                 // If we're in JSON callback mode, no tokens can be obtained
  33                 if ( !is_null( $this->getMain()->getRequest()->getVal( 'callback' ) ) ) {
  34                         $this->dieUsage( 'Cannot create account when using a callback', 'aborted' );
  35                 }
  36
  37                 // $loginForm->addNewaccountInternal will throw exceptions
  38                 // if wiki is read only (already handled by api), user is blocked or does not have rights.
  39                 // Use userCan in order to hit GlobalBlock checks (according to Special:userlogin)
  40                 $loginTitle = SpecialPage::getTitleFor( 'Userlogin' );
  41                 if ( !$loginTitle->userCan( 'createaccount', $this->getUser() ) ) {
  42                         $this->dieUsage( 'You do not have the right to create a new account', 'permdenied-createaccount' );
  43                 }
  44                 if ( $this->getUser()->isBlockedFromCreateAccount() ) {
  45                         $this->dieUsage( 'You cannot create a new account because you are blocked', 'blocked' );
  46                 }
  47
  48                 $params = $this->extractRequestParams();
  49
  50                 // Init session if necessary
  51                 if ( session_id() == '' ) {
  52                         wfSetupSession();
  53                 }
  54
  55                 if ( $params['mailpassword'] && !$params['email'] ) {
  56                         $this->dieUsageMsg( 'noemail' );
  57                 }
  58
  59                 if ( $params['language'] && !Language::isSupportedLanguage( $params['language'] ) ) {
  60                         $this->dieUsage( 'Invalid language parameter', 'langinvalid' );
  61                 }
  62
  63                 $context = new DerivativeContext( $this->getContext() );
  64                 $context->setRequest( new DerivativeRequest(
  65                         $this->getContext()->getRequest(),
  66                         array(
  67                                 'type' => 'signup',
  68                                 'uselang' => $params['language'],
  69                                 'wpName' => $params['name'],
  70                                 'wpPassword' => $params['password'],
  71                                 'wpRetype' => $params['password'],
  72                                 'wpDomain' => $params['domain'],
  73                                 'wpEmail' => $params['email'],
  74                                 'wpRealName' => $params['realname'],
  75                                 'wpCreateaccountToken' => $params['token'],
  76                                 'wpCreateaccount' => $params['mailpassword'] ? null : '1',
  77                                 'wpCreateaccountMail' => $params['mailpassword'] ? '1' : null
  78                         )
  79                 ) );
  80
  81                 $loginForm = new LoginForm();
  82                 $loginForm->setContext( $context );
  83                 $loginForm->load();
  84
  85                 $status = $loginForm->addNewaccountInternal();
  86                 $result = array();
  87                 if ( $status->isGood() ) {
  88                         // Success!
  89                         global $wgEmailAuthentication;
  90                         $user = $status->getValue();
  91
  92                         if ( $params['language'] ) {
  93                                 $user->setOption( 'language', $params['language'] );
  94                         }
  95
  96                         if ( $params['mailpassword'] ) {
  97                                 // If mailpassword was set, disable the password and send an email.
  98                                 $user->setPassword( null );
  99                                 $status->merge( $loginForm->mailPasswordInternal( $user, false, 'createaccount-title', 'createaccount-text' ) );
 100                         } elseif ( $wgEmailAuthentication && Sanitizer::validateEmail( $user->getEmail() ) ) {
 101                                 // Send out an email authentication message if needed
 102                                 $status->merge( $user->sendConfirmationMail() );
 103                         }
 104
 105                         // Save settings (including confirmation token)
 106                         $user->saveSettings();
 107
 108                         wfRunHooks( 'AddNewAccount', array( $user, $params['mailpassword'] ) );
 109
 110                         if ( $params['mailpassword'] ) {
 111                                 $logAction = 'byemail';
 112                         } elseif ( $this->getUser()->isLoggedIn() ) {
 113                                 $logAction = 'create2';
 114                         } else {
 115                                 $logAction = 'create';
 116                         }
 117                         $user->addNewUserLogEntry( $logAction, (string)$params['reason'] );
 118
 119                         // Add username, id, and token to result.
 120                         $result['username'] = $user->getName();
 121                         $result['userid'] = $user->getId();
 122                         $result['token'] = $user->getToken();
 123                 }
 124
 125                 $apiResult = $this->getResult();
 126
 127                 if ( $status->hasMessage( 'sessionfailure' ) || $status->hasMessage( 'nocookiesfornew' ) ) {
 128                         // Token was incorrect, so add it to result, but don't throw an exception
 129                         // since not having the correct token is part of the normal
 130                         // flow of events.
 131                         $result['token'] = LoginForm::getCreateaccountToken();
 132                         $result['result'] = 'needtoken';
 133                 } elseif ( !$status->isOK() ) {
 134                         // There was an error. Die now.
 135                         $this->dieStatus( $status );
 136                 } elseif ( !$status->isGood() ) {
 137                         // Status is not good, but OK. This means warnings.
 138                         $result['result'] = 'warning';
 139
 140                         // Add any warnings to the result
 141                         $warnings = $status->getErrorsByType( 'warning' );
 142                         if ( $warnings ) {
 143                                 foreach ( $warnings as &$warning ) {
 144                                         $apiResult->setIndexedTagName( $warning['params'], 'param' );
 145                                 }
 146                                 $apiResult->setIndexedTagName( $warnings, 'warning' );
 147                                 $result['warnings'] = $warnings;
 148                         }
 149                 } else {
 150                         // Everything was fine.
 151                         $result['result'] = 'success';
 152                 }
 153
 154                 $apiResult->addValue( null, 'createaccount', $result );
 155         }
 156
 157         public function getDescription() {
 158                 return 'Create a new user account.';
 159         }
 160
 161         public function mustBePosted() {
 162                 return true;
 163         }
 164
 165         public function isReadMode() {
 166                 return false;
 167         }
 168
 169         public function isWriteMode() {
 170                 return true;
 171         }
 172
 173         public function getAllowedParams() {
 174                 global $wgEmailConfirmToEdit;
 175
 176                 return array(
 177                         'name' => array(
 178                                 ApiBase::PARAM_TYPE => 'user',
 179                                 ApiBase::PARAM_REQUIRED => true
 180                         ),
 181                         'password' => null,
 182                         'domain' => null,
 183                         'token' => null,
 184                         'email' => array(
 185                                 ApiBase::PARAM_TYPE => 'string',
 186                                 ApiBase::PARAM_REQUIRED => $wgEmailConfirmToEdit
 187                         ),
 188                         'realname' => null,
 189                         'mailpassword' => array(
 190                                 ApiBase::PARAM_TYPE => 'boolean',
 191                                 ApiBase::PARAM_DFLT => false
 192                         ),
 193                         'reason' => null,
 194                         'language' => null
 195                 );
 196         }
 197
 198         public function getParamDescription() {
 199                 $p = $this->getModulePrefix();
 200
 201                 return array(
 202                         'name' => 'Username',
 203                         'password' => "Password (ignored if {$p}mailpassword is set)",
 204                         'domain' => 'Domain for external authentication (optional)',
 205                         'token' => 'Account creation token obtained in first request',
 206                         'email' => 'Email address of user (optional)',
 207                         'realname' => 'Real name of user (optional)',
 208                         'mailpassword' => 'If set to any value, a random password will be emailed to the user',
 209                         'reason' => 'Optional reason for creating the account to be put in the logs',
 210                         'language' => 'Language code to set as default for the user (optional, defaults to content language)'
 211                 );
 212         }
 213
 214         public function getResultProperties() {
 215                 return array(
 216                         'createaccount' => array(
 217                                 'result' => array(
 218                                         ApiBase::PROP_TYPE => array(
 219                                                 'success',
 220                                                 'warning',
 221                                                 'needtoken'
 222                                         )
 223                                 ),
 224                                 'username' => array(
 225                                         ApiBase::PROP_TYPE => 'string',
 226                                         ApiBase::PROP_NULLABLE => true
 227                                 ),
 228                                 'userid' => array(
 229                                         ApiBase::PROP_TYPE => 'int',
 230                                         ApiBase::PROP_NULLABLE => true
 231                                 ),
 232                                 'token' => array(
 233                                         ApiBase::PROP_TYPE => 'string',
 234                                         ApiBase::PROP_NULLABLE => true
 235                                 ),
 236                         )
 237                 );
 238         }
 239
 240         public function getPossibleErrors() {
 241                 // Note the following errors aren't possible and don't need to be listed:
 242                 // sessionfailure, nocookiesfornew, badretype
 243                 $localErrors = array(
 244                         'wrongpassword', // Actually caused by wrong domain field. Riddle me that...
 245                         'sorbs_create_account_reason',
 246                         'noname',
 247                         'userexists',
 248                         'password-name-match', // from User::getPasswordValidity
 249                         'password-login-forbidden', // from User::getPasswordValidity
 250                         'noemailtitle',
 251                         'invalidemailaddress',
 252                         'externaldberror',
 253                         'acct_creation_throttle_hit',
 254                 );
 255
 256                 $errors = parent::getPossibleErrors();
 257                 // All local errors are from LoginForm, which means they're actually message keys.
 258                 foreach ( $localErrors as $error ) {
 259                         $errors[] = array( 'code' => $error, 'info' => wfMessage( $error )->inLanguage( 'en' )->useDatabase( false )->parse() );
 260                 }
 261
 262                 $errors[] = array(
 263                         'code' => 'permdenied-createaccount',
 264                         'info' => 'You do not have the right to create a new account'
 265                 );
 266                 $errors[] = array(
 267                         'code' => 'blocked',
 268                         'info' => 'You cannot create a new account because you are blocked'
 269                 );
 270                 $errors[] = array(
 271                         'code' => 'aborted',
 272                         'info' => 'Account creation aborted by hook (info may vary)'
 273                 );
 274                 $errors[] = array(
 275                         'code' => 'langinvalid',
 276                         'info' => 'Invalid language parameter'
 277                 );
 278
 279                 // 'passwordtooshort' has parameters. :(
 280                 global $wgMinimalPasswordLength;
 281                 $errors[] = array(
 282                         'code' => 'passwordtooshort',
 283                         'info' => wfMessage( 'passwordtooshort', $wgMinimalPasswordLength )->inLanguage( 'en' )->useDatabase( false )->parse()
 284                 );
 285
 286                 return $errors;
 287         }
 288
 289         public function getExamples() {
 290                 return array(
 291                         'api.php?action=createaccount&name=testuser&password=test123',
 292                         'api.php?action=createaccount&name=testmailuser&mailpassword=true&reason=MyReason',
 293                 );
 294         }
 295
 296         public function getHelpUrls() {
 297                 return 'https://www.mediawiki.org/wiki/API:Account_creation';
 298         }
 299 }