diff --git a/classes/api.php b/classes/api.php
index 7e4691b32325d42f74df59d0ee269feefbafa055..fd783a63e866f17fd3a9dd58645a8305eadc1630 100755
--- a/classes/api.php
+++ b/classes/api.php
@@ -59,35 +59,25 @@ class API extends Handler {
if (SINGLE_USER_MODE) $login = "admin";
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE LOWER(login) = LOWER(?)");
- $sth->execute([$login]);
-
- if ($row = $sth->fetch()) {
- $uid = $row["id"];
+ if ($uid = UserHelper::find_user_by_login($login)) {
+ if (get_pref("ENABLE_API_ACCESS", $uid)) {
+ if (UserHelper::authenticate($login, $password, false, Auth_Base::AUTH_SERVICE_API)) { // try login with normal password
+ $this->wrap(self::STATUS_OK, array("session_id" => session_id(),
+ "api_level" => self::API_LEVEL));
+ } else if (UserHelper::authenticate($login, $password_base64, false, Auth_Base::AUTH_SERVICE_API)) { // else try with base64_decoded password
+ $this->wrap(self::STATUS_OK, array("session_id" => session_id(),
+ "api_level" => self::API_LEVEL));
+ } else { // else we are not logged in
+ user_error("Failed login attempt for $login from " . UserHelper::get_user_ip(), E_USER_WARNING);
+ $this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
+ }
+ } else {
+ $this->wrap(self::STATUS_ERR, array("error" => "API_DISABLED"));
+ }
} else {
- $uid = 0;
- }
-
- if (!$uid) {
$this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
return;
}
-
- if (get_pref("ENABLE_API_ACCESS", $uid)) {
- if (UserHelper::authenticate($login, $password, false, Auth_Base::AUTH_SERVICE_API)) { // try login with normal password
- $this->wrap(self::STATUS_OK, array("session_id" => session_id(),
- "api_level" => self::API_LEVEL));
- } else if (UserHelper::authenticate($login, $password_base64, false, Auth_Base::AUTH_SERVICE_API)) { // else try with base64_decoded password
- $this->wrap(self::STATUS_OK, array("session_id" => session_id(),
- "api_level" => self::API_LEVEL));
- } else { // else we are not logged in
- user_error("Failed login attempt for $login from " . UserHelper::get_user_ip(), E_USER_WARNING);
- $this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
- }
- } else {
- $this->wrap(self::STATUS_ERR, array("error" => "API_DISABLED"));
- }
-
}
function logout() {
diff --git a/classes/auth/base.php b/classes/auth/base.php
index 1d68ae537c3033ba41cc2eee3637f89c9412d56c..d54e9d8a2ef037ab3012080138b2ec16d39b4264 100644
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -15,13 +15,14 @@ abstract class Auth_Base extends Plugin implements IAuthModule {
// Auto-creates specified user if allowed by system configuration
// Can be used instead of find_user_by_login() by external auth modules
- function auto_create_user($login, $password = false) {
+ function auto_create_user(string $login, $password = false) {
if ($login && defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE) {
- $user_id = $this->find_user_by_login($login);
-
- if (!$password) $password = make_password();
+ $user_id = UserHelper::find_user_by_login($login);
if (!$user_id) {
+
+ if (!$password) $password = make_password();
+
$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
$pwd_hash = encrypt_password($password, $salt, true);
@@ -30,26 +31,18 @@ abstract class Auth_Base extends Plugin implements IAuthModule {
VALUES (LOWER(?), 0, null, NOW(), ?,?)");
$sth->execute([$login, $pwd_hash, $salt]);
- return $this->find_user_by_login($login);
+ return UserHelper::find_user_by_login($login);
} else {
return $user_id;
}
}
- return $this->find_user_by_login($login);
+ return UserHelper::find_user_by_login($login);
}
- function find_user_by_login($login) {
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
- LOWER(login) = LOWER(?)");
- $sth->execute([$login]);
-
- if ($row = $sth->fetch()) {
- return $row["id"];
- } else {
- return false;
- }
-
+ // @deprecated
+ function find_user_by_login(string $login) {
+ return UserHelper::find_user_by_login($login);
}
}
diff --git a/classes/handler/public.php b/classes/handler/public.php
index a1ed667be4d3f334846693d44110ced96a4d237e..c6310f18bb34616a9c0948e23a9eb8d424694202 100755
--- a/classes/handler/public.php
+++ b/classes/handler/public.php
@@ -248,19 +248,15 @@ class Handler_Public extends Handler {
$login = clean($_REQUEST["login"]);
$fresh = clean($_REQUEST["fresh"]) == "1";
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE LOWER(login) = LOWER(?)");
- $sth->execute([$login]);
-
- if ($row = $sth->fetch()) {
- $uid = $row["id"];
+ $uid = UserHelper::find_user_by_login($login);
+ if ($uid) {
print Feeds::getGlobalUnread($uid);
if ($fresh) {
print ";";
print Feeds::getFeedArticles(-3, false, true, $uid);
}
-
} else {
print "-1;User not found";
}
diff --git a/classes/pref/users.php b/classes/pref/users.php
index 45c4b82b8dc51ab895bf6b9db8a11b024166c53d..67daa884f5835d1e4ab824007d812c265e068b4e 100644
--- a/classes/pref/users.php
+++ b/classes/pref/users.php
@@ -237,22 +237,14 @@ class Pref_Users extends Handler_Protected {
if (!$login) return; // no blank usernames
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
- LOWER(login) = LOWER(?)");
- $sth->execute([$login]);
-
- if (!$sth->fetch()) {
+ if (!UserHelper::find_user_by_login($login)) {
$sth = $this->pdo->prepare("INSERT INTO ttrss_users
(login,pwd_hash,access_level,last_login,created, salt)
VALUES (LOWER(?), ?, 0, null, NOW(), ?)");
$sth->execute([$login, $pwd_hash, $salt]);
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
- LOWER(login) = LOWER(?) AND pwd_hash = ?");
- $sth->execute([$login, $pwd_hash]);
-
- if ($row = $sth->fetch()) {
+ if ($new_uid = UserHelper::find_user_by_login($login)) {
$new_uid = $row['id'];
diff --git a/classes/userhelper.php b/classes/userhelper.php
index 4519f280395c5985a0e60349ecb0c3cedd6fd082..6c6ad10d9379a7db0a69732b507c1925a2279e5e 100644
--- a/classes/userhelper.php
+++ b/classes/userhelper.php
@@ -1,8 +1,7 @@
<?php
class UserHelper {
- static function authenticate($login, $password, $check_only = false, $service = false) {
-
+ static function authenticate(string $login = null, string $password = null, bool $check_only = false, string $service = null) {
if (!SINGLE_USER_MODE) {
$user_id = false;
$auth_module = false;
@@ -71,7 +70,7 @@ class UserHelper {
}
}
- static function load_user_plugins($owner_uid, $pluginhost = false) {
+ static function load_user_plugins(int $owner_uid, PluginHost $pluginhost = null) {
if (!$pluginhost) $pluginhost = PluginHost::getInstance();
@@ -145,4 +144,17 @@ class UserHelper {
}
}
+ static function find_user_by_login(string $login) {
+ $pdo = Db::pdo();
+
+ $sth = $pdo->prepare("SELECT id FROM ttrss_users WHERE
+ LOWER(login) = LOWER(?)");
+ $sth->execute([$login]);
+
+ if ($row = $sth->fetch()) {
+ return $row["id"];
+ }
+
+ return false;
+ }
}
diff --git a/register.php b/register.php
index be0f9d40fe041d4aa6c80914256e40a10f67305f..dde3f2d8d78c493a6859e7d7a2fcb48099ce3653 100644
--- a/register.php
+++ b/register.php
@@ -73,12 +73,8 @@
if ($action == "check") {
header("Content-Type: application/xml");
- $login = trim(db_escape_string( $_REQUEST['login']));
-
- $result = db_query( "SELECT id FROM ttrss_users WHERE
- LOWER(login) = LOWER('$login')");
-
- $is_registered = db_num_rows($result) > 0;
+ $login = clean($_REQUEST['login']);
+ $is_registered = UserHelper::find_user_by_login($login);
print "<result>";
@@ -258,10 +254,7 @@
if ($test == "four" || $test == "4") {
- $result = db_query( "SELECT id FROM ttrss_users WHERE
- login = '$login'");
-
- $is_registered = db_num_rows($result) > 0;
+ $is_registered = UserHelper::find_user_by_login($login);
if ($is_registered) {
print_error(__('Sorry, this username is already taken.'));
@@ -279,18 +272,14 @@
(login,pwd_hash,access_level,last_login, email, created, salt)
VALUES (LOWER('$login'), '$pwd_hash', 0, null, '$email', NOW(), '$salt')");
- $result = db_query( "SELECT id FROM ttrss_users WHERE
- login = '$login' AND pwd_hash = '$pwd_hash'");
+ $new_uid = UserHelper::find_user_by_login($login);
- if (db_num_rows($result) != 1) {
+ if (!$new_uid) {
print_error(__('Registration failed.'));
print "<p><form method=\"GET\" action=\"index.php\">
<input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
</form>";
} else {
-
- $new_uid = db_fetch_result($result, 0, "id");
-
Pref_Users::initialize_user($new_uid);
$reg_text = "Hi!\n".
diff --git a/update.php b/update.php
index 0bf8f499fbc7db6d352141e64a13e2656af9172d..56158ca480003a5bc470dabd731449f2d3d96520 100755
--- a/update.php
+++ b/update.php
@@ -502,13 +502,10 @@
Debug::log("Exporting feeds of user $user to $filename as OPML...");
- $sth = $pdo->prepare("SELECT id FROM ttrss_users WHERE LOWER(login) = LOWER(?)");
- $sth->execute([$user]);
-
- if ($res = $sth->fetch()) {
+ if ($owner_uid = UserHelper::find_user_by_login($user)) {
$opml = new OPML("");
- $rc = $opml->opml_export($filename, $res["id"], false, true, true);
+ $rc = $opml->opml_export($filename, $owner_uid, false, true, true);
Debug::log($rc ? "Success." : "Failed.");
} else {