Club Drupal

<?php

/**

 * @file

 * Enables the user registration and login system.

 */

/**

 * Maximum length of username text field.

 */

define('USERNAME_MAX_LENGTH', 60);

/**

 * Maximum length of user e-mail text field.

 */

define('EMAIL_MAX_LENGTH', 254);

/**

 * Only administrators can create user accounts.

 */

define('USER_REGISTER_ADMINISTRATORS_ONLY', 0);

/**

 * Visitors can create their own accounts.

 */

define('USER_REGISTER_VISITORS', 1);

/**

 * Visitors can create accounts, but they don't become active without

 * administrative approval.

 */

define('USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL', 2);

/**

 * Implement hook_help().

 */

function user_help($path, $arg) {

  global $user;

  switch ($path) {

    case 'admin/help#user':

      $output = '';

      $output .= '<h3>' . t('About') . '</h3>';

      $output .= '<p>' . t('The User module allows users to register, log in, and log out. It also allows users with proper permissions to manage user roles (used to classify users) and permissions associated with those roles. For more information, see the online handbook entry for <a href="@user">User module</a>.', array('@user' => 'http://drupal.org/documentation/modules/user')) . '</p>';

      $output .= '<h3>' . t('Uses') . '</h3>';

      $output .= '<dl>';

      $output .= '<dt>' . t('Creating and managing users') . '</dt>';

      $output .= '<dd>' . t('The User module allows users with the appropriate <a href="@permissions">permissions</a> to create user accounts through the <a href="@people">People administration page</a>, where they can also assign users to one or more roles, and block or delete user accounts. If allowed, users without accounts (anonymous users) can create their own accounts on the <a href="@register">Create new account</a> page.', array('@permissions' => url('admin/people/permissions', array('fragment' => 'module-user')), '@people' => url('admin/people'), '@register' => url('user/register'))) . '</dd>';

      $output .= '<dt>' . t('User roles and permissions') . '</dt>';

      $output .= '<dd>' . t('<em>Roles</em> are used to group and classify users; each user can be assigned one or more roles. By default there are two roles: <em>anonymous user</em> (users that are not logged in) and <em>authenticated user</em> (users that are registered and logged in). Depending on choices you made when you installed Drupal, the installation process may have defined more roles, and you can create additional custom roles on the <a href="@roles">Roles page</a>. After creating roles, you can set permissions for each role on the <a href="@permissions_user">Permissions page</a>. Granting a permission allows users who have been assigned a particular role to perform an action on the site, such as viewing a particular type of content, editing or creating content, administering settings for a particular module, or using a particular function of the site (such as search).', array('@permissions_user' => url('admin/people/permissions'), '@roles' => url('admin/people/permissions/roles'))) . '</dd>';

      $output .= '<dt>' . t('Account settings') . '</dt>';

      $output .= '<dd>' . t('The <a href="@accounts">Account settings page</a> allows you to manage settings for the displayed name of the anonymous user role, personal contact forms, user registration, and account cancellation. On this page you can also manage settings for account personalization (including signatures and user pictures), and adapt the text for the e-mail messages that are sent automatically during the user registration process.', array('@accounts'  => url('admin/config/people/accounts'))) . '</dd>';

      $output .= '</dl>';

      return $output;

    case 'admin/people/create':

      return '<p>' . t("This web page allows administrators to register new users. Users' e-mail addresses and usernames must be unique.") . '</p>';

    case 'admin/people/permissions':

      return '<p>' . t('Permissions let you control what users can do and see on your site. You can define a specific set of permissions for each role. (See the <a href="@role">Roles</a> page to create a role). Two important roles to consider are Authenticated Users and Administrators. Any permissions granted to the Authenticated Users role will be given to any user who can log into your site. You can make any role the Administrator role for the site, meaning this will be granted all new permissions automatically. You can do this on the <a href="@settings">User Settings</a> page. You should be careful to ensure that only trusted users are given this access and level of control of your site.', array('@role' => url('admin/people/permissions/roles'), '@settings' => url('admin/config/people/accounts'))) . '</p>';

    case 'admin/people/permissions/roles':

      $output = '<p>' . t('Roles allow you to fine tune the security and administration of Drupal. A role defines a group of users that have certain privileges as defined on the <a href="@permissions">permissions page</a>. Examples of roles include: anonymous user, authenticated user, moderator, administrator and so on. In this area you will define the names and order of the roles on your site. It is recommended to order your roles from least permissive (anonymous user) to most permissive (administrator). To delete a role choose "edit role".', array('@permissions' => url('admin/people/permissions'))) . '</p>';

      $output .= '<p>' . t('By default, Drupal comes with two user roles:') . '</p>';

      $output .= '<ul>';

      $output .= '<li>' . t("Anonymous user: this role is used for users that don't have a user account or that are not authenticated.") . '</li>';

      $output .= '<li>' . t('Authenticated user: this role is automatically granted to all logged in users.') . '</li>';

      $output .= '</ul>';

      return $output;

    case 'admin/config/people/accounts/fields':

      return '<p>' . t('This form lets administrators add, edit, and arrange fields for storing user data.') . '</p>';

    case 'admin/config/people/accounts/display':

      return '<p>' . t('This form lets administrators configure how fields should be displayed when rendering a user profile page.') . '</p>';

    case 'admin/people/search':

      return '<p>' . t('Enter a simple pattern ("*" may be used as a wildcard match) to search for a username or e-mail address. For example, one may search for "br" and Drupal might return "brian", "brad", and "brenda@example.com".') . '</p>';

  }

}

/**

 * Invokes a user hook in every module.

 *

 * We cannot use module_invoke() for this, because the arguments need to

 * be passed by reference.

 *

 * @param $type

 *   A text string that controls which user hook to invoke.  Valid choices are:

 *   - cancel: Invokes hook_user_cancel().

 *   - insert: Invokes hook_user_insert().

 *   - login: Invokes hook_user_login().

 *   - presave: Invokes hook_user_presave().

 *   - update: Invokes hook_user_update().

 * @param $edit

 *   An associative array variable containing form values to be passed

 *   as the first parameter of the hook function.

 * @param $account

 *   The user account object to be passed as the second parameter of the hook

 *   function.

 * @param $category

 *   The category of user information being acted upon.

 */

function user_module_invoke($type, &$edit, $account, $category = NULL) {

  foreach (module_implements('user_' . $type) as $module) {

    $function = $module . '_user_' . $type;

    $function($edit, $account, $category);

  }

}

/**

 * Implements hook_theme().

 */

function user_theme() {

  return array(

    'user_picture' => array(

      'variables' => array('account' => NULL),

      'template' => 'user-picture',

    ),

    'user_profile' => array(

      'render element' => 'elements',

      'template' => 'user-profile',

      'file' => 'user.pages.inc',

    ),

    'user_profile_category' => array(

      'render element' => 'element',

      'template' => 'user-profile-category',

      'file' => 'user.pages.inc',

    ),

    'user_profile_item' => array(

      'render element' => 'element',

      'template' => 'user-profile-item',

      'file' => 'user.pages.inc',

    ),

    'user_list' => array(

      'variables' => array('users' => NULL, 'title' => NULL),

    ),

    'user_admin_permissions' => array(

      'render element' => 'form',

      'file' => 'user.admin.inc',

    ),

    'user_admin_roles' => array(

      'render element' => 'form',

      'file' => 'user.admin.inc',

    ),

    'user_permission_description' => array(

      'variables' => array('permission_item' => NULL, 'hide' => NULL),

      'file' => 'user.admin.inc',

    ),

    'user_signature' => array(

      'variables' => array('signature' => NULL),

    ),

  );

}

/**

 * Implements hook_entity_info().

 */

function user_entity_info() {

  $return = array(

    'user' => array(

      'label' => t('User'),

      'controller class' => 'UserController',

      'base table' => 'users',

      'uri callback' => 'user_uri',

      'label callback' => 'format_username',

      'fieldable' => TRUE,

      // $user->language is only the preferred user language for the user

      // interface textual elements. As it is not necessarily related to the

      // language assigned to fields, we do not define it as the entity language

      // key.

      'entity keys' => array(

        'id' => 'uid',

      ),

      'bundles' => array(

        'user' => array(

          'label' => t('User'),

          'admin' => array(

            'path' => 'admin/config/people/accounts',

            'access arguments' => array('administer users'),

          ),

        ),

      ),

      'view modes' => array(

        'full' => array(

          'label' => t('User account'),

          'custom settings' => FALSE,

        ),

      ),

    ),

  );

  return $return;

}

/**

 * Implements callback_entity_info_uri().

 */

function user_uri($user) {

  return array(

    'path' => 'user/' . $user->uid,

  );

}

/**

 * Implements hook_field_info_alter().

 */

function user_field_info_alter(&$info) {

  // Add the 'user_register_form' instance setting to all field types.

  foreach ($info as $field_type => &$field_type_info) {

    $field_type_info += array('instance_settings' => array());

    $field_type_info['instance_settings'] += array(

      'user_register_form' => FALSE,

    );

  }

}

/**

 * Implements hook_field_extra_fields().

 */

function user_field_extra_fields() {

  $return['user']['user'] = array(

    'form' => array(

      'account' => array(

        'label' => t('User name and password'),

        'description' => t('User module account form elements.'),

        'weight' => -10,

      ),

      'timezone' => array(

        'label' => t('Timezone'),

        'description' => t('User module timezone form element.'),

        'weight' => 6,

      ),

    ),

    'display' => array(

      'summary' => array(

        'label' => t('History'),

        'description' => t('User module history view element.'),

        'weight' => 5,

      ),

    ),

  );

  return $return;

}

/**

 * Fetches a user object based on an external authentication source.

 *

 * @param string $authname

 *   The external authentication username.

 *

 * @return

 *   A fully-loaded user object if the user is found or FALSE if not found.

 */

function user_external_load($authname) {

  $uid = db_query("SELECT uid FROM {authmap} WHERE authname = :authname", array(':authname' => $authname))->fetchField();

  if ($uid) {

    return user_load($uid);

  }

  else {

    return FALSE;

  }

}

/**

 * Load multiple users based on certain conditions.

 *

 * This function should be used whenever you need to load more than one user

 * from the database. Users are loaded into memory and will not require

 * database access if loaded again during the same page request.

 *

 * @param $uids

 *   An array of user IDs.

 * @param $conditions

 *   (deprecated) An associative array of conditions on the {users}

 *   table, where the keys are the database fields and the values are the

 *   values those fields must have. Instead, it is preferable to use

 *   EntityFieldQuery to retrieve a list of entity IDs loadable by

 *   this function.

 * @param $reset

 *   A boolean indicating that the internal cache should be reset. Use this if

 *   loading a user object which has been altered during the page request.

 *

 * @return

 *   An array of user objects, indexed by uid.

 *

 * @see entity_load()

 * @see user_load()

 * @see user_load_by_mail()

 * @see user_load_by_name()

 * @see EntityFieldQuery

 *

 * @todo Remove $conditions in Drupal 8.

 */

function user_load_multiple($uids = array(), $conditions = array(), $reset = FALSE) {

  return entity_load('user', $uids, $conditions, $reset);

}

/**

 * Controller class for users.

 *

 * This extends the DrupalDefaultEntityController class, adding required

 * special handling for user objects.

 */

class UserController extends DrupalDefaultEntityController {

  function attachLoad(&$queried_users, $revision_id = FALSE) {

    // Build an array of user picture IDs so that these can be fetched later.

    $picture_fids = array();

    foreach ($queried_users as $key => $record) {

      $picture_fids[] = $record->picture;

      $queried_users[$key]->data = unserialize($record->data);

      $queried_users[$key]->roles = array();

      if ($record->uid) {

        $queried_users[$record->uid]->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';

      }

      else {

        $queried_users[$record->uid]->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';

      }

    }

    // Add any additional roles from the database.

    $result = db_query('SELECT r.rid, r.name, ur.uid FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid IN (:uids)', array(':uids' => array_keys($queried_users)));

    foreach ($result as $record) {

      $queried_users[$record->uid]->roles[$record->rid] = $record->name;

    }

    // Add the full file objects for user pictures if enabled.

    if (!empty($picture_fids) && variable_get('user_pictures', 0)) {

      $pictures = file_load_multiple($picture_fids);

      foreach ($queried_users as $account) {

        if (!empty($account->picture) && isset($pictures[$account->picture])) {

          $account->picture = $pictures[$account->picture];

        }

        else {

          $account->picture = NULL;

        }

      }

    }

    // Call the default attachLoad() method. This will add fields and call

    // hook_user_load().

    parent::attachLoad($queried_users, $revision_id);

  }

}

/**

 * Loads a user object.

 *

 * Drupal has a global $user object, which represents the currently-logged-in

 * user. So to avoid confusion and to avoid clobbering the global $user object,

 * it is a good idea to assign the result of this function to a different local

 * variable, generally $account. If you actually do want to act as the user you

 * are loading, it is essential to call drupal_save_session(FALSE); first.

 * See

 * @link http://drupal.org/node/218104 Safely impersonating another user @endlink

 * for more information.

 *

 * @param $uid

 *   Integer specifying the user ID to load.

 * @param $reset

 *   TRUE to reset the internal cache and load from the database; FALSE

 *   (default) to load from the internal cache, if set.

 *

 * @return

 *   A fully-loaded user object upon successful user load, or FALSE if the user

 *   cannot be loaded.

 *

 * @see user_load_multiple()

 */

function user_load($uid, $reset = FALSE) {

  $users = user_load_multiple(array($uid), array(), $reset);

  return reset($users);

}

/**

 * Fetch a user object by email address.

 *

 * @param $mail

 *   String with the account's e-mail address.

 * @return

 *   A fully-loaded $user object upon successful user load or FALSE if user

 *   cannot be loaded.

 *

 * @see user_load_multiple()

 */

function user_load_by_mail($mail) {

  $users = user_load_multiple(array(), array('mail' => $mail));

  return reset($users);

}

/**

 * Fetch a user object by account name.

 *

 * @param $name

 *   String with the account's user name.

 * @return

 *   A fully-loaded $user object upon successful user load or FALSE if user

 *   cannot be loaded.

 *

 * @see user_load_multiple()

 */

function user_load_by_name($name) {

  $users = user_load_multiple(array(), array('name' => $name));

  return reset($users);

}

/**

 * Save changes to a user account or add a new user.

 *

 * @param $account

 *   (optional) The user object to modify or add. If you want to modify

 *   an existing user account, you will need to ensure that (a) $account

 *   is an object, and (b) you have set $account->uid to the numeric

 *   user ID of the user account you wish to modify. If you

 *   want to create a new user account, you can set $account->is_new to

 *   TRUE or omit the $account->uid field.

 * @param $edit

 *   An array of fields and values to save. For example array('name'

 *   => 'My name'). Key / value pairs added to the $edit['data'] will be

 *   serialized and saved in the {users.data} column.

 * @param $category

 *   (optional) The category for storing profile information in.

 *

 * @return

 *   A fully-loaded $user object upon successful save or FALSE if the save failed.

 *

 * @todo D8: Drop $edit and fix user_save() to be consistent with others.

 */

function user_save($account, $edit = array(), $category = 'account') {

  $transaction = db_transaction();

  try {

    if (!empty($edit['pass'])) {

      // Allow alternate password hashing schemes.

      require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

      $edit['pass'] = user_hash_password(trim($edit['pass']));

      // Abort if the hashing failed and returned FALSE.

      if (!$edit['pass']) {

        return FALSE;

      }

    }

    else {

      // Avoid overwriting an existing password with a blank password.

      unset($edit['pass']);

    }

    if (isset($edit['mail'])) {

      $edit['mail'] = trim($edit['mail']);

    }

    // Load the stored entity, if any.

    if (!empty($account->uid) && !isset($account->original)) {

      $account->original = entity_load_unchanged('user', $account->uid);

    }

    if (empty($account)) {

      $account = new stdClass();

    }

    if (!isset($account->is_new)) {

      $account->is_new = empty($account->uid);

    }

    // Prepopulate $edit['data'] with the current value of $account->data.

    // Modules can add to or remove from this array in hook_user_presave().

    if (!empty($account->data)) {

      $edit['data'] = !empty($edit['data']) ? array_merge($account->data, $edit['data']) : $account->data;

    }

    // Invoke hook_user_presave() for all modules.

    user_module_invoke('presave', $edit, $account, $category);

    // Invoke presave operations of Field Attach API and Entity API. Those APIs

    // require a fully-fledged and updated entity object. Therefore, we need to

    // copy any new property values of $edit into it.

    foreach ($edit as $key => $value) {

      $account->$key = $value;

    }

    field_attach_presave('user', $account);

    module_invoke_all('entity_presave', $account, 'user');

    if (is_object($account) && !$account->is_new) {

      // Process picture uploads.

      if (!empty($account->picture->fid) && (!isset($account->original->picture->fid) || $account->picture->fid != $account->original->picture->fid)) {

        $picture = $account->picture;

        // If the picture is a temporary file move it to its final location and

        // make it permanent.

        if (!$picture->status) {

          $info = image_get_info($picture->uri);

          $picture_directory =  file_default_scheme() . '://' . variable_get('user_picture_path', 'pictures');

          // Prepare the pictures directory.

          file_prepare_directory($picture_directory, FILE_CREATE_DIRECTORY);

          $destination = file_stream_wrapper_uri_normalize($picture_directory . '/picture-' . $account->uid . '-' . REQUEST_TIME . '.' . $info['extension']);

          // Move the temporary file into the final location.

          if ($picture = file_move($picture, $destination, FILE_EXISTS_RENAME)) {

            $picture->status = FILE_STATUS_PERMANENT;

            $account->picture = file_save($picture);

            file_usage_add($picture, 'user', 'user', $account->uid);

          }

        }

        // Delete the previous picture if it was deleted or replaced.

        if (!empty($account->original->picture->fid)) {

          file_usage_delete($account->original->picture, 'user', 'user', $account->uid);

          file_delete($account->original->picture);

        }

      }

      elseif (isset($edit['picture_delete']) && $edit['picture_delete']) {

        file_usage_delete($account->original->picture, 'user', 'user', $account->uid);

        file_delete($account->original->picture);

      }

      $account->picture = empty($account->picture->fid) ? 0 : $account->picture->fid;

      // Do not allow 'uid' to be changed.

      $account->uid = $account->original->uid;

      // Save changes to the user table.

      $success = drupal_write_record('users', $account, 'uid');

      if ($success === FALSE) {

        // The query failed - better to abort the save than risk further

        // data loss.

        return FALSE;

      }

      // Reload user roles if provided.

      if ($account->roles != $account->original->roles) {

        db_delete('users_roles')

          ->condition('uid', $account->uid)

          ->execute();

        $query = db_insert('users_roles')->fields(array('uid', 'rid'));

        foreach (array_keys($account->roles) as $rid) {

          if (!in_array($rid, array(DRUPAL_ANONYMOUS_RID, DRUPAL_AUTHENTICATED_RID))) {

            $query->values(array(

              'uid' => $account->uid,

              'rid' => $rid,

            ));

          }

        }

        $query->execute();

      }

      // Delete a blocked user's sessions to kick them if they are online.

      if ($account->original->status != $account->status && $account->status == 0) {

        drupal_session_destroy_uid($account->uid);

      }

      // If the password changed, delete all open sessions and recreate

      // the current one.

      if ($account->pass != $account->original->pass) {

        drupal_session_destroy_uid($account->uid);

        if ($account->uid == $GLOBALS['user']->uid) {

          drupal_session_regenerate();

        }

      }

      // Save Field data.

      field_attach_update('user', $account);

      // Send emails after we have the new user object.

      if ($account->status != $account->original->status) {

        // The user's status is changing; conditionally send notification email.

        $op = $account->status == 1 ? 'status_activated' : 'status_blocked';

        _user_mail_notify($op, $account);

      }

      // Update $edit with any interim changes to $account.

      foreach ($account as $key => $value) {

        if (!property_exists($account->original, $key) || $value !== $account->original->$key) {

          $edit[$key] = $value;

        }

      }

      user_module_invoke('update', $edit, $account, $category);

      module_invoke_all('entity_update', $account, 'user');

    }

    else {

      // Allow 'uid' to be set by the caller. There is no danger of writing an

      // existing user as drupal_write_record will do an INSERT.

      if (empty($account->uid)) {

        $account->uid = db_next_id(db_query('SELECT MAX(uid) FROM {users}')->fetchField());

      }

      // Allow 'created' to be set by the caller.

      if (!isset($account->created)) {

        $account->created = REQUEST_TIME;

      }

      $success = drupal_write_record('users', $account);

      if ($success === FALSE) {

        // On a failed INSERT some other existing user's uid may be returned.

        // We must abort to avoid overwriting their account.

        return FALSE;

      }

      // Make sure $account is properly initialized.

      $account->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';

      field_attach_insert('user', $account);

      $edit = (array) $account;

      user_module_invoke('insert', $edit, $account, $category);

      module_invoke_all('entity_insert', $account, 'user');

      // Save user roles.

      if (count($account->roles) > 1) {

        $query = db_insert('users_roles')->fields(array('uid', 'rid'));

        foreach (array_keys($account->roles) as $rid) {

          if (!in_array($rid, array(DRUPAL_ANONYMOUS_RID, DRUPAL_AUTHENTICATED_RID))) {

            $query->values(array(

              'uid' => $account->uid,

              'rid' => $rid,

            ));

          }

        }

        $query->execute();

      }

    }

    // Clear internal properties.

    unset($account->is_new);

    unset($account->original);

    // Clear the static loading cache.

    entity_get_controller('user')->resetCache(array($account->uid));

    return $account;

  }

  catch (Exception $e) {

    $transaction->rollback();

    watchdog_exception('user', $e);

    throw $e;

  }

}

/**

 * Verify the syntax of the given name.

 */

function user_validate_name($name) {

  if (!$name) {

    return t('You must enter a username.');

  }

  if (substr($name, 0, 1) == ' ') {

    return t('The username cannot begin with a space.');

  }

  if (substr($name, -1) == ' ') {

    return t('The username cannot end with a space.');

  }

  if (strpos($name, '  ') !== FALSE) {

    return t('The username cannot contain multiple spaces in a row.');

  }

  if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.\'-]/i', $name)) {

    return t('The username contains an illegal character.');

  }

  if (preg_match('/[\x{80}-\x{A0}' .         // Non-printable ISO-8859-1 + NBSP

                  '\x{AD}' .                // Soft-hyphen

                  '\x{2000}-\x{200F}' .     // Various space characters

                  '\x{2028}-\x{202F}' .     // Bidirectional text overrides

                  '\x{205F}-\x{206F}' .     // Various text hinting characters

                  '\x{FEFF}' .              // Byte order mark

                  '\x{FF01}-\x{FF60}' .     // Full-width latin

                  '\x{FFF9}-\x{FFFD}' .     // Replacement characters

                  '\x{0}-\x{1F}]/u',        // NULL byte and control characters

                  $name)) {

    return t('The username contains an illegal character.');

  }

  if (drupal_strlen($name) > USERNAME_MAX_LENGTH) {

    return t('The username %name is too long: it must be %max characters or less.', array('%name' => $name, '%max' => USERNAME_MAX_LENGTH));

  }

}

/**

 * Validates a user's email address.

 *

 * Checks that a user's email address exists and follows all standard

 * validation rules. Returns error messages when the address is invalid.

 *

 * @param $mail

 *   A user's email address.

 *

 * @return

 *   If the address is invalid, a human-readable error message is returned.

 *   If the address is valid, nothing is returned.

 */

function user_validate_mail($mail) {

  if (!$mail) {

    return t('You must enter an e-mail address.');

  }

  if (!valid_email_address($mail)) {

    return t('The e-mail address %mail is not valid.', array('%mail' => $mail));

  }

}

/**

 * Validates an image uploaded by a user.

 *

 * @see user_account_form()

 */

function user_validate_picture(&$form, &$form_state) {

  // If required, validate the uploaded picture.

  $validators = array(

    'file_validate_is_image' => array(),

    'file_validate_image_resolution' => array(variable_get('user_picture_dimensions', '85x85')),

    'file_validate_size' => array(variable_get('user_picture_file_size', '30') * 1024),

  );

  // Save the file as a temporary file.

  $file = file_save_upload('picture_upload', $validators);

  if ($file === FALSE) {

    form_set_error('picture_upload', t("Failed to upload the picture image; the %directory directory doesn't exist or is not writable.", array('%directory' => variable_get('user_picture_path', 'pictures'))));

  }

  elseif ($file !== NULL) {

    $form_state['values']['picture_upload'] = $file;

  }

}

/**

 * Generate a random alphanumeric password.

 */

function user_password($length = 10) {

  // This variable contains the list of allowable characters for the

  // password. Note that the number 0 and the letter 'O' have been

  // removed to avoid confusion between the two. The same is true

  // of 'I', 1, and 'l'.

  $allowable_characters = 'abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789';

  // Zero-based count of characters in the allowable list:

  $len = strlen($allowable_characters) - 1;

  // Declare the password as a blank string.

  $pass = '';

  // Loop the number of times specified by $length.

  for ($i = 0; $i < $length; $i++) {

    do {

      // Find a secure random number within the range needed.

      $index = ord(drupal_random_bytes(1));

    } while ($index > $len);

    // Each iteration, pick a random character from the

    // allowable string and append it to the password:

    $pass .= $allowable_characters[$index];

  }

  return $pass;

}

/**

 * Determine the permissions for one or more roles.

 *

 * @param $roles

 *   An array whose keys are the role IDs of interest, such as $user->roles.

 *

 * @return

 *   If $roles is a non-empty array, an array indexed by role ID is returned.

 *   Each value is an array whose keys are the permission strings for the given

 *   role ID. If $roles is empty nothing is returned.

 */

function user_role_permissions($roles = array()) {

  $cache = &drupal_static(__FUNCTION__, array());

  $role_permissions = $fetch = array();

  if ($roles) {

    foreach ($roles as $rid => $name) {

      if (isset($cache[$rid])) {

        $role_permissions[$rid] = $cache[$rid];

      }

      else {

        // Add this rid to the list of those needing to be fetched.

        $fetch[] = $rid;

        // Prepare in case no permissions are returned.

        $cache[$rid] = array();

      }

    }

    if ($fetch) {

      // Get from the database permissions that were not in the static variable.

      // Only role IDs with at least one permission assigned will return rows.

      $result = db_query("SELECT rid, permission FROM {role_permission} WHERE rid IN (:fetch)", array(':fetch' => $fetch));

      foreach ($result as $row) {

        $cache[$row->rid][$row->permission] = TRUE;

      }

      foreach ($fetch as $rid) {

        // For every rid, we know we at least assigned an empty array.

        $role_permissions[$rid] = $cache[$rid];

      }

    }

  }

  return $role_permissions;

}

/**

 * Determine whether the user has a given privilege.

 *

 * @param $string

 *   The permission, such as "administer nodes", being checked for.

 * @param $account

 *   (optional) The account to check, if not given use currently logged in user.

 *

 * @return

 *   Boolean TRUE if the current user has the requested permission.

 *

 * All permission checks in Drupal should go through this function. This

 * way, we guarantee consistent behavior, and ensure that the superuser

 * can perform all actions.

 */

function user_access($string, $account = NULL) {

  global $user;

  if (!isset($account)) {

    $account = $user;

  }

  // User #1 has all privileges:

  if ($account->uid == 1) {

    return TRUE;

  }

  // To reduce the number of SQL queries, we cache the user's permissions

  // in a static variable.

  // Use the advanced drupal_static() pattern, since this is called very often.

  static $drupal_static_fast;

  if (!isset($drupal_static_fast)) {

    $drupal_static_fast['perm'] = &drupal_static(__FUNCTION__);

  }

  $perm = &$drupal_static_fast['perm'];

  if (!isset($perm[$account->uid])) {

    $role_permissions = user_role_permissions($account->roles);

    $perms = array();

    foreach ($role_permissions as $one_role) {

      $perms += $one_role;

    }

    $perm[$account->uid] = $perms;

  }

  return isset($perm[$account->uid][$string]);

}

/**

 * Checks for usernames blocked by user administration.

 *

 * @param $name

 *   A string containing a name of the user.

 *

 * @return

 *   Object with property 'name' (the user name), if the user is blocked;

 *   FALSE if the user is not blocked.

 */

function user_is_blocked($name) {

  return db_select('users')

    ->fields('users', array('name'))

    ->condition('name', db_like($name), 'LIKE')

    ->condition('status', 0)

    ->execute()->fetchObject();

}

/**

 * Implements hook_permission().

 */

function user_permission() {

  return array(

    'administer permissions' =>  array(

      'title' => t('Administer permissions'),

      'restrict access' => TRUE,

    ),

    'administer users' => array(

      'title' => t('Administer users'),

      'restrict access' => TRUE,

    ),

    'access user profiles' => array(

      'title' => t('View user profiles'),

    ),

    'change own username' => array(

      'title' => t('Change own username'),

    ),

    'cancel account' => array(

      'title' => t('Cancel own user account'),

      'description' => t('Note: content may be kept, unpublished, deleted or transferred to the %anonymous-name user depending on the configured <a href="@user-settings-url">user settings</a>.', array('%anonymous-name' => variable_get('anonymous', t('Anonymous')), '@user-settings-url' => url('admin/config/people/accounts'))),

    ),

    'select account cancellation method' => array(

      'title' => t('Select method for cancelling own account'),

      'restrict access' => TRUE,

    ),

  );

}

/**

 * Implements hook_file_download().

 *

 * Ensure that user pictures (avatars) are always downloadable.

 */

function user_file_download($uri) {

  if (strpos(file_uri_target($uri), variable_get('user_picture_path', 'pictures') . '/picture-') === 0) {

    $info = image_get_info($uri);

    return array('Content-Type' => $info['mime_type']);

  }

}

/**

 * Implements hook_file_move().

 */

function user_file_move($file, $source) {

  // If a user's picture is replaced with a new one, update the record in

  // the users table.

  if (isset($file->fid) && isset($source->fid) && $file->fid != $source->fid) {

    db_update('users')

      ->fields(array(

        'picture' => $file->fid,

      ))

      ->condition('picture', $source->fid)

      ->execute();

  }

}

/**

 * Implements hook_file_delete().

 */

function user_file_delete($file) {

  // Remove any references to the file.

  db_update('users')

    ->fields(array('picture' => 0))

    ->condition('picture', $file->fid)

    ->execute();

}

/**

 * Implements hook_search_info().

 */

function user_search_info() {

  return array(

    'title' => 'Users',

  );

}

/**

 * Implements hook_search_access().

 */

function user_search_access() {

  return user_access('access user profiles');

}

/**

 * Implements hook_search_execute().

 */

function user_search_execute($keys = NULL, $conditions = NULL) {

  $find = array();

  // Replace wildcards with MySQL/PostgreSQL wildcards.

  $keys = preg_replace('!\*+!', '%', $keys);

  $query = db_select('users')->extend('PagerDefault');

  $query->fields('users', array('uid'));

  if (user_access('administer users')) {

    // Administrators can also search in the otherwise private email field,

    // and they don't need to be restricted to only active users.

    $query->fields('users', array('mail'));

    $query->condition(db_or()->

      condition('name', '%' . db_like($keys) . '%', 'LIKE')->

      condition('mail', '%' . db_like($keys) . '%', 'LIKE'));

  }

  else {

    // Regular users can only search via usernames, and we do not show them

    // blocked accounts.

    $query->condition('name', '%' . db_like($keys) . '%', 'LIKE')

      ->condition('status', 1);

  }

  $uids = $query

    ->limit(15)

    ->execute()

    ->fetchCol();

  $accounts = user_load_multiple($uids);

  $results = array();

  foreach ($accounts as $account) {

    $result = array(

      'title' => format_username($account),

      'link' => url('user/' . $account->uid, array('absolute' => TRUE)),

    );

    if (user_access('administer users')) {

      $result['title'] .= ' (' . $account->mail . ')';

    }

    $results[] = $result;

  }

  return $results;

}

/**

 * Implements hook_element_info().

 */

function user_element_info() {

  $types['user_profile_category'] = array(

    '#theme_wrappers' => array('user_profile_category'),

  );

  $types['user_profile_item'] = array(

    '#theme' => 'user_profile_item',

  );

  return $types;

}

/**

 * Implements hook_user_view().

 */

function user_user_view($account) {

  $account->content['user_picture'] = array(

    '#markup' => theme('user_picture', array('account' => $account)),

    '#weight' => -10,

  );

  if (!isset($account->content['summary'])) {

    $account->content['summary'] = array();

  }

  $account->content['summary'] += array(

    '#type' => 'user_profile_category',

    '#attributes' => array('class' => array('user-member')),

    '#weight' => 5,

    '#title' => t('History'),

  );

  $account->content['summary']['member_for'] = array(

    '#type' => 'user_profile_item',

    '#title' => t('Member for'),

    '#markup' => format_interval(REQUEST_TIME - $account->created),

  );

}

/**

 * Helper function to add default user account fields to user registration and edit form.

 *

 * @see user_account_form_validate()

 * @see user_validate_current_pass()

 * @see user_validate_picture()

 * @see user_validate_mail()

 */

function user_account_form(&$form, &$form_state) {

  global $user;

  $account = $form['#user'];

  $register = ($form['#user']->uid > 0 ? FALSE : TRUE);

  $admin = user_access('administer users');

  $form['#validate'][] = 'user_account_form_validate';

  // Account information.

  $form['account'] = array(

    '#type'   => 'container',

    '#weight' => -10,

  );

  // Only show name field on registration form or user can change own username.

  $form['account']['name'] = array(

    '#type' => 'textfield',

    '#title' => t('Username'),

    '#maxlength' => USERNAME_MAX_LENGTH,

    '#description' => t('Spaces are allowed; punctuation is not allowed except for periods, hyphens, apostrophes, and underscores.'),

    '#required' => TRUE,

    '#attributes' => array('class' => array('username')),

    '#default_value' => (!$register ? $account->name : ''),

    '#access' => ($register || ($user->uid == $account->uid && user_access('change own username')) || $admin),

    '#weight' => -10,

  );

  $form['account']['mail'] = array(

    '#type' => 'textfield',

    '#title' => t('E-mail address'),

    '#maxlength' => EMAIL_MAX_LENGTH,

    '#description' => t('A valid e-mail address. All e-mails from the system will be sent to this address. The e-mail address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by e-mail.'),

    '#required' => TRUE,

    '#default_value' => (!$register ? $account->mail : ''),

  );

  // Display password field only for existing users or when user is allowed to

  // assign a password during registration.

  if (!$register) {

    $form['account']['pass'] = array(

      '#type' => 'password_confirm',

      '#size' => 25,

      '#description' => t('To change the current user password, enter the new password in both fields.'),

    );

    // To skip the current password field, the user must have logged in via a

    // one-time link and have the token in the URL.

    $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);

    $protected_values = array();

    $current_pass_description = '';

    // The user may only change their own password without their current

    // password if they logged in via a one-time login link.

    if (!$pass_reset) {

      $protected_values['mail'] = $form['account']['mail']['#title'];

      $protected_values['pass'] = t('Password');

      $request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));

      $current_pass_description = t('Enter your current password to change the %mail or %pass. !request_new.', array('%mail' => $protected_values['mail'], '%pass' => $protected_values['pass'], '!request_new' => $request_new));

    }

    // The user must enter their current password to change to a new one.

    if ($user->uid == $account->uid) {

      $form['account']['current_pass_required_values'] = array(

        '#type' => 'value',

        '#value' => $protected_values,

      );

      $form['account']['current_pass'] = array(

        '#type' => 'password',

        '#title' => t('Current password'),

        '#size' => 25,

        '#access' => !empty($protected_values),

        '#description' => $current_pass_description,

        '#weight' => -5,

        // Do not let web browsers remember this password, since we are trying

        // to confirm that the person submitting the form actually knows the

        // current one.

        '#attributes' => array('autocomplete' => 'off'),

      );

      $form['#validate'][] = 'user_validate_current_pass';

    }

  }

  elseif (!variable_get('user_email_verification', TRUE) || $admin) {

    $form['account']['pass'] = array(

      '#type' => 'password_confirm',

      '#size' => 25,

      '#description' => t('Provide a password for the new account in both fields.'),

      '#required' => TRUE,

    );

  }

  if ($admin) {

    $status = isset($account->status) ? $account->status : 1;

  }

  else {

    $status = $register ? variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_VISITORS : $account->status;

  }

  $form['account']['status'] = array(

    '#type' => 'radios',

    '#title' => t('Status'),

    '#default_value' => $status,

    '#options' => array(t('Blocked'), t('Active')),

    '#access' => $admin,

  );

  $roles = array_map('check_plain', user_roles(TRUE));

  // The disabled checkbox subelement for the 'authenticated user' role

  // must be generated separately and added to the checkboxes element,

  // because of a limitation in Form API not supporting a single disabled

  // checkbox within a set of checkboxes.

  // @todo This should be solved more elegantly. See issue #119038.

  $checkbox_authenticated = array(

    '#type' => 'checkbox',

    '#title' => $roles[DRUPAL_AUTHENTICATED_RID],

    '#default_value' => TRUE,

    '#disabled' => TRUE,

  );

  unset($roles[DRUPAL_AUTHENTICATED_RID]);

  $form['account']['roles'] = array(

    '#type' => 'checkboxes',

    '#title' => t('Roles'),

    '#default_value' => (!$register && isset($account->roles) ? array_keys($account->roles) : array()),

    '#options' => $roles,

    '#access' => $roles && user_access('administer permissions'),

    DRUPAL_AUTHENTICATED_RID => $checkbox_authenticated,

  );

  $form['account']['notify'] = array(

    '#type' => 'checkbox',

    '#title' => t('Notify user of new account'),

    '#access' => $register && $admin,

  );

  // Signature.

  $form['signature_settings'] = array(

    '#type' => 'fieldset',

    '#title' => t('Signature settings'),

    '#weight' => 1,

    '#access' => (!$register && variable_get('user_signatures', 0)),

  );

  $form['signature_settings']['signature'] = array(

    '#type' => 'text_format',

    '#title' => t('Signature'),

    '#default_value' => isset($account->signature) ? $account->signature : '',

    '#description' => t('Your signature will be publicly displayed at the end of your comments.'),

    '#format' => isset($account->signature_format) ? $account->signature_format : NULL,

  );

  // Picture/avatar.

  $form['picture'] = array(

    '#type' => 'fieldset',

    '#title' => t('Picture'),

    '#weight' => 1,

    '#access' => (!$register && variable_get('user_pictures', 0)),

  );

  $form['picture']['picture'] = array(

    '#type' => 'value',

    '#value' => isset($account->picture) ? $account->picture : NULL,

  );

  $form['picture']['picture_current'] = array(

    '#markup' => theme('user_picture', array('account' => $account)),

  );

  $form['picture']['picture_delete'] = array(

    '#type' => 'checkbox',

    '#title' => t('Delete picture'),

    '#access' => !empty($account->picture->fid),

    '#description' => t('Check this box to delete your current picture.'),

  );

  $form['picture']['picture_upload'] = array(

    '#type' => 'file',

    '#title' => t('Upload picture'),

    '#size' => 48,

    '#description' => t('Your virtual face or picture. Pictures larger than @dimensions pixels will be scaled down.', array('@dimensions' => variable_get('user_picture_dimensions', '85x85'))) . ' ' . filter_xss_admin(variable_get('user_picture_guidelines', '')),

  );

  $form['#validate'][] = 'user_validate_picture';

}

/**

 * Form validation handler for the current password on the user_account_form().

 *

 * @see user_account_form()

 */

function user_validate_current_pass(&$form, &$form_state) {

  $account = $form['#user'];

  foreach ($form_state['values']['current_pass_required_values'] as $key => $name) {

    // This validation only works for required textfields (like mail) or

    // form values like password_confirm that have their own validation

    // that prevent them from being empty if they are changed.

    if ((strlen(trim($form_state['values'][$key])) > 0) && ($form_state['values'][$key] != $account->$key)) {

      require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

      $current_pass_failed = empty($form_state['values']['current_pass']) || !user_check_password($form_state['values']['current_pass'], $account);

      if ($current_pass_failed) {

        form_set_error('current_pass', t("Your current password is missing or incorrect; it's required to change the %name.", array('%name' => $name)));

        form_set_error($key);

      }

      // We only need to check the password once.

      break;

    }

  }

}

/**

 * Form validation handler for user_account_form().

 *

 * @see user_account_form()

 */

function user_account_form_validate($form, &$form_state) {

  if ($form['#user_category'] == 'account' || $form['#user_category'] == 'register') {

    $account = $form['#user'];

    // Validate new or changing username.

    if (isset($form_state['values']['name'])) {

      if ($error = user_validate_name($form_state['values']['name'])) {

        form_set_error('name', $error);

      }

      elseif ((bool) db_select('users')->fields('users', array('uid'))->condition('uid', $account->uid, '<>')->condition('name', db_like($form_state['values']['name']), 'LIKE')->range(0, 1)->execute()->fetchField()) {

        form_set_error('name', t('The name %name is already taken.', array('%name' => $form_state['values']['name'])));

      }

    }

    // Trim whitespace from mail, to prevent confusing 'e-mail not valid'

    // warnings often caused by cutting and pasting.

    $mail = trim($form_state['values']['mail']);

    form_set_value($form['account']['mail'], $mail, $form_state);

    // Validate the e-mail address, and check if it is taken by an existing user.

    if ($error = user_validate_mail($form_state['values']['mail'])) {

      form_set_error('mail', $error);

    }

    elseif ((bool) db_select('users')->fields('users', array('uid'))->condition('uid', $account->uid, '<>')->condition('mail', db_like($form_state['values']['mail']), 'LIKE')->range(0, 1)->execute()->fetchField()) {

      // Format error message dependent on whether the user is logged in or not.

      if ($GLOBALS['user']->uid) {

        form_set_error('mail', t('The e-mail address %email is already taken.', array('%email' => $form_state['values']['mail'])));

      }

      else {

        form_set_error('mail', t('The e-mail address %email is already registered. <a href="@password">Have you forgotten your password?</a>', array('%email' => $form_state['values']['mail'], '@password' => url('user/password'))));

      }

    }

    // Make sure the signature isn't longer than the size of the database field.

    // Signatures are disabled by default, so make sure it exists first.

    if (isset($form_state['values']['signature'])) {

      // Move text format for user signature into 'signature_format'.

      $form_state['values']['signature_format'] = $form_state['values']['signature']['format'];

      // Move text value for user signature into 'signature'.

      $form_state['values']['signature'] = $form_state['values']['signature']['value'];

      $user_schema = drupal_get_schema('users');

      if (drupal_strlen($form_state['values']['signature']) > $user_schema['fields']['signature']['length']) {

        form_set_error('signature', t('The signature is too long: it must be %max characters or less.', array('%max' => $user_schema['fields']['signature']['length'])));

      }

    }

  }

}

/**

 * Implements hook_user_presave().

 */

function user_user_presave(&$edit, $account, $category) {

  if ($category == 'account' || $category == 'register') {

    if (!empty($edit['picture_upload'])) {

      $edit['picture'] = $edit['picture_upload'];

    }

    // Delete picture if requested, and if no replacement picture was given.

    elseif (!empty($edit['picture_delete'])) {

      $edit['picture'] = NULL;

    }

    // Prepare user roles.

    if (isset($edit['roles'])) {

      $edit['roles'] = array_filter($edit['roles']);

    }

  }

  // Move account cancellation information into $user->data.

  foreach (array('user_cancel_method', 'user_cancel_notify') as $key) {

    if (isset($edit[$key])) {

      $edit['data'][$key] = $edit[$key];

    }

  }

}

/**

 * Implements hook_user_categories().

 */

function user_user_categories() {

  return array(array(

    'name' => 'account',

    'title' => t('Account settings'),

    'weight' => 1,

  ));

}

function user_login_block($form) {

  $form['#action'] = url(current_path(), array('query' => drupal_get_destination(), 'external' => FALSE));

  $form['#id'] = 'user-login-form';

  $form['#validate'] = user_login_default_validators();

  $form['#submit'][] = 'user_login_submit';

  $form['name'] = array('#type' => 'textfield',

    '#title' => t('Username'),

    '#maxlength' => USERNAME_MAX_LENGTH,

    '#size' => 15,

    '#required' => TRUE,

  );

  $form['pass'] = array('#type' => 'password',

    '#title' => t('Password'),

    '#size' => 15,

    '#required' => TRUE,

  );

  $form['actions'] = array('#type' => 'actions');

  $form['actions']['submit'] = array('#type' => 'submit',

    '#value' => t('Log in'),

  );

  $items = array();

  if (variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL)) {

    $items[] = l(t('Create new account'), 'user/register', array('attributes' => array('title' => t('Create a new user account.'))));

  }

  $items[] = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));

  $form['links'] = array('#markup' => theme('item_list', array('items' => $items)));

  return $form;

}

/**

 * Implements hook_block_info().

 */

function user_block_info() {

  global $user;

  $blocks['login']['info'] = t('User login');

  // Not worth caching.

  $blocks['login']['cache'] = DRUPAL_NO_CACHE;

  $blocks['new']['info'] = t('Who\'s new');

  $blocks['new']['properties']['administrative'] = TRUE;

  // Too dynamic to cache.

  $blocks['online']['info'] = t('Who\'s online');

  $blocks['online']['cache'] = DRUPAL_NO_CACHE;

  $blocks['online']['properties']['administrative'] = TRUE;

  return $blocks;

}

/**

 * Implements hook_block_configure().

 */

function user_block_configure($delta = '') {

  global $user;

  switch ($delta) {

    case 'new':

      $form['user_block_whois_new_count'] = array(

        '#type' => 'select',

        '#title' => t('Number of users to display'),

        '#default_value' => variable_get('user_block_whois_new_count', 5),

        '#options' => drupal_map_assoc(array(1, 2, 3, 4, 5, 6, 7, 8, 9, 10)),

      );

      return $form;

    case 'online':

      $period = drupal_map_assoc(array(30, 60, 120, 180, 300, 600, 900, 1800, 2700, 3600, 5400, 7200, 10800, 21600, 43200, 86400), 'format_interval');

      $form['user_block_seconds_online'] = array('#type' => 'select', '#title' => t('User activity'), '#default_value' => variable_get('user_block_seconds_online', 900), '#options' => $period, '#description' => t('A user is considered online for this long after they have last viewed a page.'));

      $form['user_block_max_list_count'] = array('#type' => 'select', '#title' => t('User list length'), '#default_value' => variable_get('user_block_max_list_count', 10), '#options' => drupal_map_assoc(array(0, 5, 10, 15, 20, 25, 30, 40, 50, 75, 100)), '#description' => t('Maximum number of currently online users to display.'));

      return $form;

  }

}

/**

 * Implements hook_block_save().

 */

function user_block_save($delta = '', $edit = array()) {

  global $user;

  switch ($delta) {

    case 'new':

      variable_set('user_block_whois_new_count', $edit['user_block_whois_new_count']);

      break;

    case 'online':

      variable_set('user_block_seconds_online', $edit['user_block_seconds_online']);

      variable_set('user_block_max_list_count', $edit['user_block_max_list_count']);

      break;

  }

}

/**

 * Implements hook_block_view().

 */

function user_block_view($delta = '') {

  global $user;

  $block = array();

  switch ($delta) {

    case 'login':

      // For usability's sake, avoid showing two login forms on one page.

      if (!$user->uid && !(arg(0) == 'user' && !is_numeric(arg(1)))) {

        $block['subject'] = t('User login');

        $block['content'] = drupal_get_form('user_login_block');

      }

      return $block;

    case 'new':

      if (user_access('access content')) {

        // Retrieve a list of new users who have subsequently accessed the site successfully.

        $items = db_query_range('SELECT uid, name FROM {users} WHERE status <> 0 AND access <> 0 ORDER BY created DESC', 0, variable_get('user_block_whois_new_count', 5))->fetchAll();

        $output = theme('user_list', array('users' => $items));

        $block['subject'] = t('Who\'s new');

        $block['content'] = $output;

      }

      return $block;

    case 'online':

      if (user_access('access content')) {

        // Count users active within the defined period.

        $interval = REQUEST_TIME - variable_get('user_block_seconds_online', 900);

        // Perform database queries to gather online user lists. We use s.timestamp

        // rather than u.access because it is much faster.

        $authenticated_count = db_query("SELECT COUNT(DISTINCT s.uid) FROM {sessions} s WHERE s.timestamp >= :timestamp AND s.uid > 0", array(':timestamp' => $interval))->fetchField();

        $output = '<p>' . format_plural($authenticated_count, 'There is currently 1 user online.', 'There are currently @count users online.') . '</p>';

        // Display a list of currently online users.

        $max_users = variable_get('user_block_max_list_count', 10);

        if ($authenticated_count && $max_users) {

          $items = db_query_range('SELECT u.uid, u.name, MAX(s.timestamp) AS max_timestamp FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.timestamp >= :interval AND s.uid > 0 GROUP BY u.uid, u.name ORDER BY max_timestamp DESC', 0, $max_users, array(':interval' => $interval))->fetchAll();

          $output .= theme('user_list', array('users' => $items));

        }

        $block['subject'] = t('Who\'s online');

        $block['content'] = $output;

      }

      return $block;

  }

}

/**

 * Process variables for user-picture.tpl.php.

 *

 * The $variables array contains the following arguments:

 * - $account: A user, node or comment object with 'name', 'uid' and 'picture'

 *   fields.

 *

 * @see user-picture.tpl.php

 */

function template_preprocess_user_picture(&$variables) {

  $variables['user_picture'] = '';

  if (variable_get('user_pictures', 0)) {

    $account = $variables['account'];

    if (!empty($account->picture)) {

      // @TODO: Ideally this function would only be passed file objects, but

      // since there's a lot of legacy code that JOINs the {users} table to

      // {node} or {comments} and passes the results into this function if we

      // a numeric value in the picture field we'll assume it's a file id

      // and load it for them. Once we've got user_load_multiple() and

      // comment_load_multiple() functions the user module will be able to load

      // the picture files in mass during the object's load process.

      if (is_numeric($account->picture)) {

        $account->picture = file_load($account->picture);

      }

      if (!empty($account->picture->uri)) {

        $filepath = $account->picture->uri;

      }

    }

    elseif (variable_get('user_picture_default', '')) {

      $filepath = variable_get('user_picture_default', '');

    }

    if (isset($filepath)) {

      $alt = t("@user's picture", array('@user' => format_username($account)));

      // If the image does not have a valid Drupal scheme (for eg. HTTP),

      // don't load image styles.

      if (module_exists('image') && file_valid_uri($filepath) && $style = variable_get('user_picture_style', '')) {

        $variables['user_picture'] = theme('image_style', array('style_name' => $style, 'path' => $filepath, 'alt' => $alt, 'title' => $alt));

      }

      else {

        $variables['user_picture'] = theme('image', array('path' => $filepath, 'alt' => $alt, 'title' => $alt));

      }

      if (!empty($account->uid) && user_access('access user profiles')) {

        $attributes = array('attributes' => array('title' => t('View user profile.')), 'html' => TRUE);

        $variables['user_picture'] = l($variables['user_picture'], "user/$account->uid", $attributes);

      }

    }

  }

}

/**

 * Returns HTML for a list of users.

 *

 * @param $variables

 *   An associative array containing:

 *   - users: An array with user objects. Should contain at least the name and

 *     uid.

 *   - title: (optional) Title to pass on to theme_item_list().

 *

 * @ingroup themeable

 */

function theme_user_list($variables) {

  $users = $variables['users'];

  $title = $variables['title'];

  $items = array();

  if (!empty($users)) {

    foreach ($users as $user) {

      $items[] = theme('username', array('account' => $user));

    }

  }

  return theme('item_list', array('items' => $items, 'title' => $title));

}

/**

 * Determines if the current user is anonymous.

 *

 * @return bool

 *   TRUE if the user is anonymous, FALSE if the user is authenticated.

 */

function user_is_anonymous() {

  // Menu administrators can see items for anonymous when administering.

  return !$GLOBALS['user']->uid || !empty($GLOBALS['menu_admin']);

}

/**

 * Determines if the current user is logged in.

 *

 * @return bool

 *   TRUE if the user is logged in, FALSE if the user is anonymous.

 */

function user_is_logged_in() {

  return (bool) $GLOBALS['user']->uid;

}

/**

 * Determines if the current user has access to the user registration page.

 *

 * @return bool

 *   TRUE if the user is not already logged in and can register for an account.

 */

function user_register_access() {

  return user_is_anonymous() && variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL);

}

/**

 * User view access callback.

 *

 * @param $account

 *   Can either be a full user object or a $uid.

 */

function user_view_access($account) {

  $uid = is_object($account) ? $account->uid : (int) $account;

  // Never allow access to view the anonymous user account.

  if ($uid) {

    // Admins can view all, users can view own profiles at all times.

    if ($GLOBALS['user']->uid == $uid || user_access('administer users')) {

      return TRUE;

    }

    elseif (user_access('access user profiles')) {

      // At this point, load the complete account object.